Vercel Sandbox firewall now supports request proxying and filtering

The Vercel Sandbox firewall now supports forwarding specific HTTP requests to a proxy you control. You can also use matchers to filter forwarding and credentials brokering to only the requests that need it.

Link to headingRequests proxying

You can now route outbound sandbox traffic through your own proxy for logging, debugging, or transforming requests and responses. Set a forwardURL on any allowed domain, and the firewall will forward matching HTTPS requests to your server.

The proxy receives the original request along with additional headers to identify the source:

• vercel-forwarded-host: The original request's SNI

• vercel-forwarded-scheme: The original request's scheme

• vercel-forwarded-port: The original request's port

• vercel-sandbox-oidc-token: A Vercel-issued OIDC token that the proxy can use to authenticate the request and identity the source team / project / sandbox. Learn more about it in the docs

1
import { Sandbox } from '@vercel/sandbox';
2

3
// Sandbox has access to everything, with a proxy for requests towards github.com
4
const sandbox = await Sandbox.create({
5
  networkPolicy: {
6
    allow: {
7
      "github.com": [{
8
        forwardURL: "https://my-custom-proxy.vercel.app/api/proxy"
9
      }],
10
      // Allow traffic to all other domains. If unset only defined ones are reachable.
11
      "*": []
12
    }
13
  }
14
});

Link to headingFiltering

Additionally, you can now use matchers to filter request forwarding or credentials brokering to requests matching a specific path, method, query string, or headers. This gives you fine-grained control over which requests get transformed; for example, only forwarding POST requests to a specific API path while allowing all other traffic through untouched.

1
import { Sandbox } from '@vercel/sandbox';
2

3
// Sandbox has access to everything, with a proxy for requests towards POST github.com/api/*
4
// Other requests to github.com are allowed and not proxied
5
const sandbox = await Sandbox.create({
6
  networkPolicy: {
7
    allow: {
8
      "api.github.com": [{
9
        match: {
10
          path: { startsWith: "/v1" },
11
          method: ["POST"]
12
        },
13
        forwardURL: "https://my-custom-proxy.vercel.app/api/proxy"
14
      }],
15
      // Allow traffic to all other domains. If unset only defined ones are reachable.
16
      "*": []
17
    }
18
  }
19
});

These features are available in beta for Pro and Enterprise plans. Get started by installing the @vercel/sandbox@beta SDK, and learn more in the docs about requests proxying and matchers.