feat: Add a speedier script tag for prerendered redirects (#9911)

* feat: Add a script redirect to prerendered pages

* changeset

* Update .changeset/hungry-rocks-hunt.md

Co-authored-by: Simon H <5968653+dummdidumm@users.noreply.github.com>

* fix test

* feat: Update string escaping

* Update .changeset/hungry-rocks-hunt.md

Co-authored-by: Conduitry <git@chor.date>

---------

Co-authored-by: Simon H <5968653+dummdidumm@users.noreply.github.com>
Co-authored-by: Conduitry <git@chor.date>

Author: 3 people

.changeset/hungry-rocks-hunt.md

@@ -0,0 +1,5 @@
+---
+'@sveltejs/kit': patch
+---
+
+perf: add `<script>` to prerendered redirects for faster redirects

packages/kit/src/core/postbuild/prerender.js

@@ -12,6 +12,7 @@ import { get_route_segments } from '../../utils/routing.js';
 import { queue } from './queue.js';
 import { crawl } from './crawl.js';
 import { forked } from '../../utils/fork.js';
+import * as devalue from 'devalue';
 
 export default forked(import.meta.url, prerender);
 
@@ -340,7 +341,11 @@ async function prerender({ out, manifest_path, metadata, verbose, env }) {
 
 					writeFileSync(
 						dest,
-						`<meta http-equiv="refresh" content=${escape_html_attr(`0;url=${location}`)}>`
+						`<script>location.href=${devalue.uneval(
+							location
+						)};</script><meta http-equiv="refresh" content=${escape_html_attr(
+							`0;url=${location}`
+						)}>`
 					);
 
 					written.add(file);

packages/kit/test/prerendering/basics/src/routes/redirect-encoded/+page.svelte

@@ -0,0 +1,6 @@
+import { redirect } from '@sveltejs/kit';
+
+/** @type {import('@sveltejs/kit').Load} */
+export function load() {
+	throw redirect(301, '/env');
+}

packages/kit/test/prerendering/basics/src/routes/redirect-malicious/+page.svelte

@@ -16,13 +16,16 @@ test('renders a redirect', () => {
 	const content = read('redirect.html');
 	assert.equal(
 		content,
-		'<meta http-equiv="refresh" content="0;url=https://example.com/redirected">'
+		'<script>location.href="https:\\u002F\\u002Fexample.com\\u002Fredirected";</script><meta http-equiv="refresh" content="0;url=https://example.com/redirected">'
 	);
 });
 
 test('renders a server-side redirect', () => {
 	const html = read('redirect-server.html');
-	assert.equal(html, '<meta http-equiv="refresh" content="0;url=https://example.com/redirected">');
+	assert.equal(
+		html,
+		'<script>location.href="https:\\u002F\\u002Fexample.com\\u002Fredirected";</script><meta http-equiv="refresh" content="0;url=https://example.com/redirected">'
+	);
 
 	const data = JSON.parse(read('redirect-server/__data.json'));
 
@@ -36,15 +39,23 @@ test('does not double-encode redirect locations', () => {
 	const content = read('redirect-encoded.html');
 	assert.equal(
 		content,
-		'<meta http-equiv="refresh" content="0;url=https://example.com/redirected?returnTo=%2Ffoo%3Fbar%3Dbaz">'
+		'<script>location.href="https:\\u002F\\u002Fexample.com\\u002Fredirected?returnTo=%2Ffoo%3Fbar%3Dbaz";</script><meta http-equiv="refresh" content="0;url=https://example.com/redirected?returnTo=%2Ffoo%3Fbar%3Dbaz">'
 	);
 });
 
 test('escapes characters in redirect', () => {
 	const content = read('redirect-malicious.html');
 	assert.equal(
 		content,
-		'<meta http-equiv="refresh" content="0;url=https://example.com/</script>alert(&quot;pwned&quot;)">'
+		'<script>location.href="https:\\u002F\\u002Fexample.com\\u002F\\u003C\\u002Fscript\\u003Ealert(\\"pwned\\")";</script><meta http-equiv="refresh" content="0;url=https://example.com/</script>alert(&quot;pwned&quot;)">'
+	);
+});
+
+test('renders a relative redirect', () => {
+	const content = read('redirect-relative.html');
+	assert.equal(
+		content,
+		'<script>location.href="\\u002Fenv";</script><meta http-equiv="refresh" content="0;url=/env">'
 	);
 });
 

packages/kit/test/prerendering/basics/src/routes/redirect-relative/+page.js

@@ -14,7 +14,10 @@ test('prerenders /path-base', () => {
 
 test('prerenders /path-base/redirect', () => {
 	const content = read('redirect.html');
-	assert.equal(content, '<meta http-equiv="refresh" content="0;url=/path-base/dynamic/foo">');
+	assert.equal(
+		content,
+		'<script>location.href="\\u002Fpath-base\\u002Fdynamic\\u002Ffoo";</script><meta http-equiv="refresh" content="0;url=/path-base/dynamic/foo">'
+	);
 });
 
 test('prerenders /path-base/dynamic/foo', () => {