EAS Hosting request URL vs incoming URL difference
EAS Hosting routes requests from several hostnames (aliases and custom domains) to deployments, which means there is a difference between the incoming URL that clients use and the target URL that API routes receive. While request.url contains the worker deployment's URL (with deployment ID), the Origin and X-Forwarded-Host headers are set to the incoming URL that the client used. For example, a client requesting https://my-app--staging.expo.app/ will have the API route receive request.url as https://my-app--or1170q9ix.expo.app/ but Origin and X-Forwarded-Host as my-app--staging.expo.app.
EAS Hosting IP header retrieval example
To retrieve the IP address of a user's browser making an API request, read the X-Real-IP header. The Forwarded header contains a comma-separated list where the first entry's for parameter is likely the original client's IP address. X-Forwarded-For contains only a comma-separated list of IP addresses representing proxies that forwarded the request.
EAS Hosting geo headers available in requests
EAS Hosting includes the following geographical headers in requests: eas-colo contains the Cloudflare data center code (e.g., lhr); eas-ip-continent contains the continent code (AF, AN, AS, EU, NA, OC, SA); eas-ip-country contains the ISO-3166 Alpha 2 country code (e.g., US or JP, at most two letters); eas-ip-region contains the ISO-3166-2 region code (maximum three characters, varies by country); eas-ip-city contains a human-readable city name (e.g., London or Chicago); eas-ip-latitude and eas-ip-longitude contain approximate coordinates; eas-ip-timezone contains the timezone (e.g., Europe/London); eas-ip-eu is set to 1 when the request likely originated in the European Union.
EAS Hosting default CORS response headers
If an API route does not handle OPTIONS requests, EAS Hosting automatically responds with default CORS headers: Access-Control-Allow-Origin: <origin || '*'>, Access-Control-Allow-Headers: <access-control-request-headers || '*'>, Access-Control-Allow-Methods: GET, POST, PUT, PATCH, DELETE, Access-Control-Allow-Credentials: true, Access-Control-Expose-Headers: *, Access-Control-Max-Age: 3600, and Vary: Origin, Access-Control-Request-Headers. These defaults allow any client to make requests from any origin with any headers and credentials, caching the OPTIONS response for 3600 seconds. To override this permissive default, handle OPTIONS requests in API routes yourself.
Using Node.js modules in EAS Hosting API routes
Any Node.js module listed in the compatibility table can be used in API routes or in dependencies of API routes as usual and will use appropriate compatibility modules. However, some modules may not provide practical functionality and only exist to shim APIs to prevent runtime crashes. Modules not listed are unavailable or unsupported, and code and dependencies should not rely on them.
Node.js compatibility modules as polyfills
The Node.js compatibility modules provided by EAS Hosting generally offer lower-accuracy polyfills or approximations of their Node.js counterparts. For example, the fs, http, and https modules have additional restrictions and are Node.js compatibility layers that are not equivalent to running them in a Node.js process.
Supported JavaScript runtime globals in EAS Hosting
The following globals are supported: origin (always matches incoming request Origin header), process (available), process.env (populated with EAS Hosting environment variables), process.stdout (redirects to console.log), process.stderr (redirects to console.error), setImmediate, clearImmediate, Buffer (from node:buffer), EventEmitter (from node:events), global (set to globalThis), WeakRef, FinalizationRegistry. The following are partially supported (<AlertIcon />): require (external requires supported for deployed JS files and built-in modules, but Node module resolution unsupported). The following are not supported (<NoIcon />): require.cache.
Supported Node.js built-in modules in EAS Hosting
The following Node.js built-in modules are fully supported (<YesIcon />): node:assert, node:async_hooks, node:buffer, node:constants, node:events, node:path, node:path/posix, node:path/win32, node:querystring, node:stream, node:stream/consumers, node:stream/web, node:string_decoder, node:test, node:timers, node:url, node:util, node:util/types, node:zlib. The following are partially or conditionally supported (<AlertIcon />): node:console (partial JS shims), node:crypto (select deprecated algorithms unavailable), node:diagnostics_channel (select deprecated algorithms unimplemented), node:http2 (partial, server functionality unsupported), node:module (SourceMap unimplemented), node:net (Server and BlockList unimplemented, client sockets partially supported), node:trace_events (non-functional JS stubs). The following are not supported (<NoIcon />): node:punycode, node:readline (non-functional stubs, no stdin), node:worker_threads (non-functional stubs, no threading). The following have limited support: node:crypto (select deprecated algorithms not available), node:dns (Resolver unimplemented, all DNS requests sent to Cloudflare), node:fs (in-memory filesystem), node:http (except server functionality), node:https (except server functionality), node:os (JS stubs with Linux mock values), node:process (JS stubs), node:tls (except server functionality), node:tty (JS shims redirecting to Console API).
EAS Hosting Node.js compatibility overview
EAS Hosting runtime is part of Winter TC and is more similar to JavaScript environments in browsers and service workers rather than traditional Node.js. Many Node.js APIs and dependencies are not directly available. Node.js compatibility modules exist and can be used in API routes to ease this transition.
EAS Hosting runtime platform
EAS Hosting is built on Cloudflare Workers, a serverless platform for APIs. The runtime uses the V8 JavaScript engine, the same engine that powers JavaScript in Node.js and Chromium.
EAS Hosting V8 isolates and request execution
Instead of each request running in a full JavaScript process, Workers are designed to run requests in small V8 isolates, which are micro-containers within a single JavaScript process.
EAS Hosting purpose
EAS Hosting deploys Expo Router and React Native web apps and API routes.