Fix: Remove legacy app_id header to support self-hosting with Caddy

[abshari]

What this PR does

This PR removes the legacy app_id header from the uploadFile Storage API method, ensuring we only send the compliant 'app-id' header.

Why this is necessary

Currently, the @instantdb/core client sends the App ID for file uploads using both 'app-id' and the legacy app_id HTTP headers. The 'app-id' header was recently added on August 6th, but the old underscored header was left behind.

The official self-hosting docker-compose.yml uses Caddy as the reverse proxy. Caddy has a strict, hardcoded security rule that silently drops any HTTP headers containing underscores, and there is no configuration option to override this behavior. Furthermore, sending headers with underscores can cause other strict reverse proxies (like Nginx) to behave unpredictably or reject requests entirely depending on configuration.

By removing the legacy underscored header, we ensure the client strictly sends the compliant dash version (app-id). The InstantDB backend already seamlessly accepts app-id, so this cleanup entirely resolves the broken upload flow for self-hosters without requiring any server-side changes.

Testing

• Verified that removing the legacy app_id header and strictly using app-id successfully bypasses Caddy and allows file uploads to complete on a self-hosted instance.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Repository UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 68551848-1d34-4a58-a5bd-7e366da7d512

📥 Commits

Reviewing files that changed from the base of the PR and between 4e0a1bd and ebdc490.

📒 Files selected for processing (1)

• client/packages/core/src/StorageAPI.ts

💤 Files with no reviewable changes (1)

• client/packages/core/src/StorageAPI.ts

Included review availability: Your plan provides up to 10 included reviews per hour; 9 remain after this review.

---

📝 Walkthrough

Walkthrough

The uploadFile request now sends the application identifier with the app-id header key instead of app_id.

Changes

Cohort / File(s)	Summary
Storage upload header client/packages/core/src/StorageAPI.ts	Renames the uploadFile request header from app_id to app-id.

Estimated code review effort: 1 (Trivial) | ~2 minutes

Merge Risk: ⚪ Minimal · up to ebdc4

This is a localized header rename for file uploads, and no actionable merge-blocking risk remains after normal checks and review.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0…
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Title check	✅ Passed	The title clearly identifies removal of the legacy app_id header and its purpose for Caddy-based self-hosting. This matches the primary change.
Description check	✅ Passed	The description accurately explains the header rename, the Caddy compatibility issue, the backend behavior, and the testing performed.

Full details: Docstring Coverage

Explanation

No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0 files.

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}