fix: remove unnecessary path validation which breaks fetch with custom path base #15291

goulinkh · 2026-02-09T16:06:28Z

When having a custom base path:

{
  kit: {
  	paths: {
  		base: '/ui'
  	}
  }
}

And making a request to a different server hosted on the same domain, +layout.server.ts:

export const load: LayoutServerLoad = async ({ fetch }) => {
  const workingResponse = await fetch('/ui/api'); // works if api is defined in sveltekit
  const failingResponse = await fetch('/profile'); // returns 404, instead of making request and providing cookies
}

Making a request to the same origin but to a different server not with the configured paths.base, currently doesn't work but this should be allowed and possible as they share the same domain name.

Please don't delete this checklist! Before submitting the PR, please make sure you do the following:

It's really useful if your PR references an issue where it is discussed ahead of time. In many cases, features are absent for a reason. For large changes, please create an RFC: https://github.com/sveltejs/rfcs
This message body should clearly illustrate what problems it solves.
Ideally, include a test that fails without this PR but passes with it.

Tests

Run the tests with pnpm test and lint the project with pnpm lint and pnpm check

Changesets

If your PR makes a change that should be noted in one or more packages' changelogs, generate a changeset by running pnpm changeset and following the prompts. Changesets that add features should be minor and those that fix bugs should be patch. Please prefix changeset messages with feat:, fix:, or chore:.

Edits

Please ensure that 'Allow edits from maintainers' is checked. PRs without this option may be closed.

changeset-bot · 2026-02-09T16:06:36Z

🦋 Changeset detected

Latest commit: 208b2ab

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 1 package

Name	Type
@sveltejs/kit	Patch

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

svelte-docs-bot · 2026-02-09T16:07:02Z

Preview: https://svelte-dev-git-preview-kit-15291-svelte.vercel.app/

svelte-docs-bot · 2026-02-09T16:07:04Z

Preview: https://svelte-dev-git-preview-kit-15291-svelte.vercel.app/

packages/kit/test/apps/options/source/pages/routing/link-outside-base/+page.svelte

…base`

PatrickG · 2026-02-09T17:48:47Z

I don't think this is the correct fix.
The request shouldn't even be handled by the respond function.
It must be fixed somewhere in the fetch function in src/runtime/server/fetch.js

Maybe changing

kit/packages/kit/src/runtime/server/fetch.js

Line 58 in 8a59a0d

if (url.origin !== event.url.origin) {

to something like

if (url.origin !== event.url.origin || (paths.base && !decodeURIComponent(url.pathname).startsWith(paths.base))) {

goulinkh · 2026-02-09T18:10:35Z

Hi @PatrickG, apologies for the quick fix attempt, I lack knowledge in sveltekit codebase but tried to file the fix.

Your suggestion makes sense, I've applied it and it seems to work locally.

Cheers!

packages/kit/src/runtime/server/fetch.js

…ded pathname

packages/kit/src/runtime/server/fetch.js

…etch

teemingc · 2026-02-11T17:03:05Z

packages/kit/test/apps/dev-only/src/routes/request-abort/+page.svelte

 				async (r) => (result = await r.json())
 			);
-		}, 100);
+		}, 50);


Why was this reduced?

The test was flaky, it was failing randomly in the CI and locally, reducing the abort signal timing helped.

Should I revert this change?

teemingc · 2026-02-11T17:09:43Z

.changeset/honest-cobras-jog.md

@@ -0,0 +1,5 @@
+---
+'@sveltejs/kit': major


Suggested change

'@sveltejs/kit': major

'@sveltejs/kit': patch

It should only be major for a breaking change (of a previously valid behaviour?). However, I don't think anyone would purposely try to have the load fetch trigger the SvelteKit server response if it's requesting an entirely different path

teemingc · 2026-02-11T17:26:25Z

packages/kit/test/apps/options/test/paths-assets.test.js

+		expect(await page.locator('[data-testid="fetch-url"]').textContent()).toContain(
+			`${baseURL}/not-base-path/`
+		);
+		expect(await page.locator('[data-testid="fetch-response"]').textContent()).toContain(


Passing a locator and awaiting the expect is the recommended Playwright API

Suggested change

expect(await page.locator('[data-testid="fetch-url"]').textContent()).toContain(

`${baseURL}/not-base-path/`

);

expect(await page.locator('[data-testid="fetch-response"]').textContent()).toContain(

await expect(page.locator('[data-testid="fetch-url"]')).toHaveText(

`${baseURL}/not-base-path/`

);

await expect(page.locator('[data-testid="fetch-response"]')).toHaveText(

teemingc · 2026-02-11T17:28:10Z

packages/kit/test/apps/options/test/paths-assets.test.js

+	test('fetch to root succeeds', async ({ page, baseURL }) => {
+		await page.goto('/path-base/fetch/link-root/');
+		// fetch to root with trailing slash
+		expect(await page.locator('[data-testid="fetch1-url"]').textContent()).toContain(`${baseURL}/`);
+		const fetch1Response = await page.locator('[data-testid="fetch1-response"]').textContent();
+		const fetch1Redirect = await page.locator('[data-testid="fetch1-redirect"]').textContent();
+		expect(
+			// production
+			fetch1Response?.includes('did you mean to visit') ||
+				// dev
+				fetch1Redirect === '/path-base'
+		).toBe(true);
+
+		// fetch to root without trailing slash should be relative
+		expect(await page.locator('[data-testid="fetch2-url"]').textContent()).toBeFalsy();
+		expect(await page.locator('[data-testid="fetch2-response"]').textContent()).toBe('relative');
+
+		// fetch to root with custom base path with trailing slash
+		expect(await page.locator('[data-testid="fetch3-url"]').textContent()).toBeFalsy();
+		expect(await page.locator('[data-testid="fetch3-response"]').textContent()).toBe('root');
+
+		// fetch to root with custom base path without trailing slash
+		expect(await page.locator('[data-testid="fetch4-url"]').textContent()).toBeFalsy();
+		expect(await page.locator('[data-testid="fetch4-redirect"]').textContent()).toBe('/path-base/');
+	});


I'm not sure if we need this test. It doesn't help validate that the non-base path URL is fetchable. Does this test fail before the fix is applied?

no it was working before as well, I will remove the base path URL fetches 👍

teemingc

Thanks for the PR! I left a few comments

goulinkh force-pushed the fix-custom-base-fetch branch from 0df3081 to fe1a7a2 Compare February 9, 2026 16:15

vercel bot reviewed Feb 9, 2026

View reviewed changes

packages/kit/test/apps/options/source/pages/routing/link-outside-base/+page.svelte Outdated Show resolved Hide resolved

fix: resolve fetch issue with same host URLs differing from `paths.…

db812b3

…base`

goulinkh force-pushed the fix-custom-base-fetch branch from fe1a7a2 to db812b3 Compare February 9, 2026 16:22

fix: enhance fetch and respond logic for base path handling

eb708f3

refactor: improve testing for link outside base path

7a1700b

PatrickG reviewed Feb 9, 2026

View reviewed changes

packages/kit/src/runtime/server/fetch.js Show resolved Hide resolved

fix: ensure correct base path handling in fetch logic by reusing deco…

8d450d9

…ded pathname

vercel bot reviewed Feb 9, 2026

View reviewed changes

packages/kit/src/runtime/server/fetch.js Outdated Show resolved Hide resolved

goulinkh added 3 commits February 10, 2026 11:40

fix: add more test cases and include additional check for base path f…

295b2b6

…etch

Merge branch 'main' into fix-custom-base-fetch

5ec2276

fix: reduce timeout duration in request-abort test

038ec8a

goulinkh requested a review from PatrickG February 11, 2026 10:59

refactor: improve testing

1daafbd

teemingc reviewed Feb 11, 2026

View reviewed changes

teemingc requested changes Feb 11, 2026

View reviewed changes

fix: update changeset and improve test assertions

208b2ab

goulinkh requested a review from teemingc February 11, 2026 17:45

Uh oh!

fix: remove unnecessary path validation which breaks fetch with custom path base #15291

Are you sure you want to change the base?

fix: remove unnecessary path validation which breaks fetch with custom path base #15291

Conversation

goulinkh commented Feb 9, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Please don't delete this checklist! Before submitting the PR, please make sure you do the following:

Tests

Changesets

Edits

Uh oh!

changeset-bot bot commented Feb 9, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

🦋 Changeset detected

Uh oh!

svelte-docs-bot bot commented Feb 9, 2026

Uh oh!

svelte-docs-bot bot commented Feb 9, 2026

Uh oh!

Uh oh!

PatrickG commented Feb 9, 2026

Uh oh!

goulinkh commented Feb 9, 2026

Uh oh!

Uh oh!

Uh oh!

teemingc Feb 11, 2026

Choose a reason for hiding this comment

Uh oh!

goulinkh Feb 11, 2026

Choose a reason for hiding this comment

Uh oh!

teemingc Feb 11, 2026

Choose a reason for hiding this comment

Uh oh!

teemingc Feb 11, 2026

Choose a reason for hiding this comment

Uh oh!

teemingc Feb 11, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

goulinkh Feb 11, 2026

Choose a reason for hiding this comment

Uh oh!

teemingc left a comment

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

goulinkh commented Feb 9, 2026 •

edited

Loading

changeset-bot bot commented Feb 9, 2026 •

edited

Loading

teemingc Feb 11, 2026 •

edited

Loading