fix(account-settings): decode URL-encoded city in active sessions#1503
fix(account-settings): decode URL-encoded city in active sessions#1503aadesh18 wants to merge 2 commits into
Conversation
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: defaults Review profile: CHILL Plan: Pro Run ID: 📒 Files selected for processing (1)
🚧 Files skipped from review as they are similar to previous changes (1)
📝 WalkthroughWalkthroughBackend introduces ChangesVercel Geo Header Decoding
🎯 3 (Moderate) | ⏱️ ~20 minutes
🚥 Pre-merge checks | ✅ 4 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (4 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches📝 Generate docstrings
🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
There was a problem hiding this comment.
Pull request overview
Fixes display of multi-word city names in the Active Sessions table by decoding URL-encoded Vercel geo headers both at ingestion and at render time.
Changes:
- Decode
x-vercel-ip-city(and similar) at the source inend-users.tsxvia a newdecodeVercelGeoHeaderhelper, with fallback to the raw value on invalid encoding. - Defensively decode the city name at display time in the Active Sessions page with a local
decodeCityNamehelper. - Adds in-source unit tests covering both the successful decoding path and the invalid-encoding fallback.
Reviewed changes
Copilot reviewed 2 out of 2 changed files in this pull request and generated no comments.
| File | Description |
|---|---|
| apps/backend/src/lib/end-users.tsx | Adds decodeVercelGeoHeader, applies it to both trusted and spoofed city names, and adds two unit tests. |
| packages/template/src/components-page/account-settings/active-sessions/active-sessions-page.tsx | Adds decodeCityName helper and uses it when rendering session.geoInfo.cityName. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
Greptile SummaryThis PR fixes URL-encoded city names (e.g.
Confidence Score: 5/5Safe to merge — both decode paths fall back to the raw value on error, the unit tests validate both the successful decode and the invalid-encoding fallback, and no existing behavior is broken. The change is narrow: two small helper functions applied at well-understood call sites. Edge cases (invalid percent-encoding, empty/null values, already-decoded stored data) are all handled. Unit test coverage is present and meaningful. No files require special attention; the only observation is that the two decode helpers are copies of each other across packages. Important Files Changed
Sequence DiagramsequenceDiagram
participant Vercel as Vercel Proxy
participant Backend as end-users.tsx
participant DB as Database
participant UI as ActiveSessionsPage
Vercel->>Backend: x-vercel-ip-city: San%20Francisco
Note over Backend: decodeVercelGeoHeader()<br/>San%20Francisco → San Francisco
Backend->>DB: store cityName: "San Francisco"
UI->>DB: fetch sessions
DB-->>UI: "cityName: "San Francisco" (new)<br/>or cityName: "San%20Francisco" (old)"
Note over UI: decodeCityName()<br/>"San Francisco" → "San Francisco" (no-op)<br/>"San%20Francisco" → "San Francisco" (legacy fix)
UI-->>UI: display "San Francisco"
Prompt To Fix All With AIFix the following 1 code review issue. Work through them one at a time, proposing concise fixes.
---
### Issue 1 of 1
packages/template/src/components-page/account-settings/active-sessions/active-sessions-page.tsx:11-19
`decodeCityName` is byte-for-byte identical to `decodeVercelGeoHeader` in the backend. Since this template already imports from `@stackframe/stack-shared`, a shared utility would keep the fallback logic in one place. If that's out of scope here, at least a comment noting the duplication would help future maintainers find both sites if the logic ever needs to change.
```suggestion
// Some geo providers (e.g. Vercel) URL-encode city names, so "San Francisco" arrives as "San%20Francisco".
// Decode defensively for display, falling back to the raw value if it isn't valid percent-encoding.
// NOTE: This mirrors `decodeVercelGeoHeader` in apps/backend/src/lib/end-users.tsx; keep them in sync.
function decodeCityName(cityName: string): string {
try {
return decodeURIComponent(cityName);
} catch {
return cityName;
}
}
```
Reviews (1): Last reviewed commit: "fix(account-settings): decode URL-encode..." | Re-trigger Greptile |
![greptile-apps[bot]](https://avatars.githubusercontent.com/in/867647?s=60&v=4){kind=small}
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 2
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@apps/backend/src/lib/end-users.tsx`:
- Around line 95-96: In decodeVercelGeoHeader, replace the falsy check `if
(!raw)` with an explicit nullish check (e.g., `if (raw == null)`) so that empty
strings are not treated the same as null/undefined; update the early-return
condition inside the function to use that nullish check.
In
`@packages/template/src/components-page/account-settings/active-sessions/active-sessions-page.tsx`:
- Line 211: Replace the truthy check on session.geoInfo?.cityName in the
ActiveSessionsPage JSX so it uses an explicit nullish check: instead of using
the boolean check currently around decodeCityName(session.geoInfo.cityName), use
session.geoInfo?.cityName == null to decide when to render t('Unknown') vs
decodeCityName(session.geoInfo.cityName); keep the call to decodeCityName and
the surrounding Typography element unchanged except for the conditional
expression.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro
Run ID: d7580198-dd62-4f43-a950-9a0277b6beee
📒 Files selected for processing (2)
apps/backend/src/lib/end-users.tsxpackages/template/src/components-page/account-settings/active-sessions/active-sessions-page.tsx
![cubic-dev-ai[bot]](https://avatars.githubusercontent.com/in/1082092?s=60&v=4){kind=small}
There was a problem hiding this comment.
No issues found across 2 files
Tip: cubic could auto-approve low-risk PRs like this, if it thinks it's safe to merge. Learn more
Re-trigger cubic
aadesh18
force-pushed
the
fix/active-sessions-location-url-encoding
branch
from
6a203c4 to
9e26ab2
Compare
The Active Sessions table showed locations like "San%20Francisco" instead of "San Francisco". Vercel percent-encodes its geolocation headers, and the city name was stored verbatim without decoding. Decode the city name where the Vercel geo header is read, so recorded sessions store the human-readable name. Falls back to the raw value if it isn't valid percent-encoding, so a stray "%" can't break things.
aadesh18
force-pushed
the
fix/active-sessions-location-url-encoding
branch
from
9e26ab2 to
6e61f68
Compare
Summary
The Active Sessions table in account settings showed locations like
San%20Franciscoinstead ofSan Francisco.Vercel percent-encodes its geolocation headers (e.g.
x-vercel-ip-city), so a multi-word city arrives URL-encoded. The city name was being stored verbatim, so the raw%20leaked into the UI.The fix decodes the city name where the Vercel geo header is read, so recorded sessions store the human-readable name. This also benefits any other consumer of the location data. It falls back to the raw value if it isn't valid percent-encoding, so a stray
%can't break things.Test plan
apps/backend/src/lib/end-users.tsx): simulating Vercel headers withx-vercel-ip-city: San%20Francisconow yieldscityName: "San Francisco"; an invalid-encoding value (100% Real City) passes through unchanged instead of throwing. All 8 tests in the file pass.San Francisco) with no%20.Summary by CodeRabbit
Bug Fixes
Tests