Vercel proxy

A Routing Middleware file for any project on Vercel, whatever its framework. It answers one path the dashboard issued, on your own domain, and forwards only the browser SDK's submissions to Fingerly. It is not an open proxy: the upstream is a constant in the code, and every other path and method is refused. Version 1.0.0.

Set up

1. 01

   Step 1: Create the proxy

   In the dashboard, open Integration > Proxy keys and choose New proxy. Pick the environment of the public key it will forward, and Vercel under How it runs. Copy the proxy key it shows once, and note the path it issued, such as /k7x2qm4a.

   The dashboard then prints the steps below, filled in with your proxy's own path and key. They stay under Show setup in the proxy's menu, without the key, which is never shown again.

2. 02

   Step 2: Add middleware.ts

   Save middleware.ts at the root of your project, beside package.json. It has no dependencies, only the web-standard Request and Response. The path appears twice, in config.matcher and in PATH, and both must hold yours; the dashboard prints the file with them filled in.

   middleware.ts

   export const config = { matcher: '/k7x2qm4a' }
   
   /** The path the dashboard issued. Keep it equal to the matcher above. */
   const PATH = '/k7x2qm4a'
   // ... the rest of the file, as the dashboard prints it
   

3. 03

   Step 3: Add the proxy key

   As a sensitive environment variable, or in the project's Settings > Environment Variables.

   Terminal

   vercel env add FINGERLY_PROXY_KEY production --value "fly_px_production_…" --sensitive --yes
   

4. 04

   Step 4: Deploy

   The middleware runs from the next production deployment.

   Terminal

   vercel deploy --prod
   

5. 05

   Step 5: Point the browser SDK at the path

   fingerly.ts

   import { load } from '@fingerly/web-js'
   
   const fingerly = await load({
     apiKey: 'fly_pk_production_…',
     endpoints: '/k7x2qm4a',
   })
   

   The SDK posts both of its calls to the path exactly as given. Once pages use it, the proxy's row in Proxy keys shows it last seen, running vercel/1.0.0, with its requests over the last 30 days.

How the visitor's address is trusted

The middleware sends x-real-ip as x-fingerly-client-ip, falling back to the first x-forwarded-for entry. Vercel sets both itself, and overwrites x-forwarded-for with the client's address rather than passing on what the visitor sent, so on Vercel neither can be forged.

What it sends and relays

Upstream, to https://api.fingerly.io/api/v1/ingest and nowhere else, on headers built from scratch: content-type, x-api-key, Idempotency-Key when present, and the x-fingerly-* headers the proxy sets itself (the proxy key, the visitor's address, the page origin, the user agent and x-fingerly-proxy-version: vercel/1.0.0). Cookies, Authorization and any x-fingerly-* header a visitor sends never leave.

Other methods answer 405 with Allow: POST, and other paths 404. Bodies over 1 MiB are refused with 413, redirects are not followed, and a missing or malformed key answers 503 rather than forwarding anything.

Back to the page: the API's status and body, with only content-type, x-request-id, ratelimit-limit, ratelimit-remaining and retry-after, plus cache-control: no-store. Nothing relayed names Fingerly.