From 4be043d96eccfe9472ae26e18b82d88eada23d96 Mon Sep 17 00:00:00 2001
From: conico974 <nicodorseuil@yahoo.fr>
Date: Wed, 5 Aug 2026 09:50:26 +0200
Subject: [PATCH] Add support for visitor token revalidation without
 redirection (#4463)

---
 packages/gitbook/src/lib/visitors.test.ts | 12 ++++++++++++
 packages/gitbook/src/lib/visitors.ts      |  9 +++++++++
 packages/gitbook/src/middleware.ts        |  7 ++++++-
 3 files changed, 27 insertions(+), 1 deletion(-)

diff --git a/packages/gitbook/src/lib/visitors.test.ts b/packages/gitbook/src/lib/visitors.test.ts
index 664883fa7..9054b8658 100644
--- a/packages/gitbook/src/lib/visitors.test.ts
+++ b/packages/gitbook/src/lib/visitors.test.ts
@@ -21,6 +21,18 @@ describe('getVisitorAuthToken', () => {
         ).toEqual({ source: 'url', token: '123' });
     });
 
+    it('should return a revalidation token for requests from the revalidation worker', () => {
+        expect(
+            getVisitorToken({
+                cookies: [],
+                headers: new Headers({
+                    'User-Agent': 'GitBook-Open-Revalidation-Worker',
+                }),
+                url: new URL('https://example.com?jwt_token=123'),
+            })
+        ).toEqual({ source: 'revalidation', token: '123' });
+    });
+
     it('should return the token from the cookie root basepath', () => {
         const visitorAuth = getVisitorToken({
             cookies: [
diff --git a/packages/gitbook/src/lib/visitors.ts b/packages/gitbook/src/lib/visitors.ts
index a8aee0b80..170edf731 100644
--- a/packages/gitbook/src/lib/visitors.ts
+++ b/packages/gitbook/src/lib/visitors.ts
@@ -79,6 +79,11 @@ export type VisitorTokenLookup =
           source: 'visitor-oauth-protected';
           token: string;
       }
+    | {
+          /** A visitor token used for revalidation purposes. This is coming from our backend and we don't want to redirect in this case */
+          source: 'revalidation';
+          token: string;
+      }
     /** Not visitor token was found */
     | undefined;
 
@@ -130,6 +135,10 @@ export function getVisitorToken({
 
     // Allow the empty string to come through
     if (fromUrl !== null && fromUrl !== undefined) {
+        if (headers.get('user-agent')?.toLowerCase() === 'gitbook-open-revalidation-worker') {
+            return { source: 'revalidation', token: fromUrl };
+        }
+
         return { source: 'url', token: fromUrl };
     }
 
diff --git a/packages/gitbook/src/middleware.ts b/packages/gitbook/src/middleware.ts
index 176b6273b..94aa5deee 100644
--- a/packages/gitbook/src/middleware.ts
+++ b/packages/gitbook/src/middleware.ts
@@ -335,11 +335,16 @@ async function serveSiteRoutes(requestURL: URL, request: NextRequest) {
         // Make sure the URL is clean of any va token after a successful lookup,
         // and of any visitor.* params that may have been passed to the URL.
         //
+        // We only redirect if the visitor token is not coming from a revalidation request, as we don't want to redirect in that case.
+        //
         // The token and the visitor.* params value are stored in cookies that are set
         // on the redirect response.
         //
         const normalizedVisitorURL = normalizeVisitorURL(incomingURL);
-        if (normalizedVisitorURL.toString() !== incomingURL.toString()) {
+        if (
+            normalizedVisitorURL.toString() !== incomingURL.toString() &&
+            visitorToken?.source !== 'revalidation'
+        ) {
             return writeResponseCookies(
                 NextResponse.redirect(normalizedVisitorURL.toString()),
                 cookies