Server Side Cookies

// Serves Triggerbee from your own domain, so it's first-party
// Set PREFIX to where you want it mounted. Nothing else in this file needs changing
const PREFIX = '/tb';
const UPSTREAM = 'https://t.myvisitors.se';

const TRACKER_PATHS = /^\/(js(\/\d+)?|(3\/|4\/)?t|visitor-state\/[a-z-]+(\/[a-z-]+)*)$/;
const EVENT_PATHS = /^\/((3\/|4\/)?t)$/;
const SKIPPED_HEADERS = new Set([
  'connection', 'keep-alive', 'proxy-authenticate', 'proxy-authorization',
  'te', 'trailer', 'transfer-encoding', 'upgrade', 'host',
]);

export default {
  async fetch(request, env) {
    const url = new URL(request.url);

    if (url.pathname !== PREFIX && !url.pathname.startsWith(`${PREFIX}/`)) {
      return fetch(request);
    }
    const path = url.pathname.slice(PREFIX.length) || '/';
    if (!TRACKER_PATHS.test(path)) {
      return fetch(request);
    }

    const headers = new Headers();
    for (const [name, value] of request.headers) {
      if (!SKIPPED_HEADERS.has(name.toLowerCase())) {
        headers.set(name, value);
      }
    }
    headers.set('X-Forwarded-Host', url.host);
    headers.set('X-Forwarded-Proto', url.protocol.replace(':', ''));
    headers.set('X-Client-IP', request.headers.get('CF-Connecting-IP') ?? '');
    // Always ours, never copied from the request: the key is what will tell Triggerbee this IP came from your proxy.
    headers.delete('X-TB-Proxy-Key');
    if (env && env.TB_PROXY_KEY) {
      headers.set('X-TB-Proxy-Key', env.TB_PROXY_KEY);
    }

    const upstream = new URL(path + url.search, UPSTREAM);
    let response;
    try {
      response = await fetch(upstream, {
        method: request.method,
        headers,
        body: request.method === 'GET' || request.method === 'HEAD' ? undefined : request.body,
        redirect: 'manual',
      });
    } catch {
      return new Response('', { status: 502 });
    }

    const out = new Headers(response.headers);
    out.delete('set-cookie');
    for (const cookie of response.headers.getSetCookie()) {
      out.append('set-cookie', cookie);
    }
    if (EVENT_PATHS.test(path)) {
      out.set('cache-control', 'no-store');
    }

    return new Response(response.body, { status: response.status, headers: out });
  },
};