Vercel Sandbox 防火墙新增请求代理和过滤功能

Vercel Sandbox firewall now supports request proxying and filtering - Vercel

Skip to content

[](https://vercel.com/home)

• Products

• ##### AI Cloud

• AI Gateway One endpoint, all your models
• Sandbox Isolated, safe code execution
• Vercel Agent An agent that knows your stack
• AI SDK The AI Toolkit for TypeScript
• v0 Build applications with AI

• ##### Core Platform

• CI/CD Helping teams ship 6× faster
• Content Delivery Fast, scalable, and reliable
• Fluid Compute Servers, in serverless form
• Workflow Long-running workflows at scale
• Observability Trace every step

• ##### Security

• Bot Management Scalable bot protection
• BotID Invisible CAPTCHA
• Platform Security DDoS Protection, Firewall
• Web Application Firewall Granular, custom protection

• Resources

• ##### Company

• Customers Trusted by the best teams
• Blog The latest posts and changes
• Changelog See what shipped
• Press Read the latest news
• Events Join us at an event

• ##### Learn

• Docs Vercel documentation
• Academy Linear courses to level up
• Knowledge Base Find help quickly
• Community Join the conversation

• ##### Open Source

• Next.js The native Next.js platform
• Nuxt The progressive web framework
• Svelte The web’s efficient UI framework
• Turborepo Speed with Enterprise scale

• Solutions

• ##### Use Cases

• AI Apps Deploy at the speed of AI
• Composable Commerce Power storefronts that convert
• Marketing Sites Launch campaigns fast
• Multi-tenant Platforms Scale apps with one codebase
• Web Apps Ship features, not infrastructure

• ##### Tools

• Marketplace Extend and automate workflows
• Templates Jumpstart app development
• Partner Finder Get help from solution partners

• ##### Users

• Platform Engineers Automate away repetition
• Design Engineers Deploy for every idea

• Enterprise
• Pricing

Ask AI

Ask AILog In

Sign UpSign Up

Blog/Changelog

Vercel Sandbox firewall now supports request proxying and filtering

Authors


1 min read

Copy URL

Copied to clipboard!

May 11, 2026

The Vercel Sandbox firewall now supports forwarding specific HTTP requests to a proxy you control. You can also use matchers to filter forwarding and credentials brokering to only the requests that need it.

[Link to heading](https://vercel.com/changelog/vercel-sandbox-firewall-now-supports-request-proxying-and-filtering#requests-proxying)Requests proxying

You can now route outbound sandbox traffic through your own proxy for logging, debugging, or transforming requests and responses. Set a forwardURL on any allowed domain, and the firewall will forward matching HTTPS requests to your server.

The proxy receives the original request along with additional headers to identify the source:

• vercel-forwarded-host: The original request's SNI

• vercel-forwarded-scheme: The original request's scheme

• vercel-forwarded-port: The original request's port

• vercel-sandbox-oidc-token: A Vercel-issued OIDC token that the proxy can use to authenticate the request and identity the source team / project / sandbox. Learn more about it in the docs

1import { Sandbox } from '@vercel/sandbox';2
3// Sandbox has access to everything, with a proxy for requests towards github.com4const sandbox = await Sandbox.create({5  networkPolicy: {6    allow: {7      "github.com": [{8        forwardURL: "https://my-custom-proxy.vercel.app/api/proxy"9      }],10      // Allow traffic to all other domains. If unset only defined ones are reachable.11      "*": []12    }13  }14});

[Link to heading](https://vercel.com/changelog/vercel-sandbox-firewall-now-supports-request-proxying-and-filtering#filtering)Filtering

Additionally, you can now use matchers to filter request forwarding or credentials brokering to requests matching a specific path, method, query string, or headers. This gives you fine-grained control over which requests get transformed; for example, only forwarding POST requests to a specific API path while allowing all other traffic through untouched.

1import { Sandbox } from '@vercel/sandbox';2
3// Sandbox has access to everything, with a proxy for requests towards POST github.com/api/*4// Other requests to github.com are allowed and not proxied5const sandbox = await Sandbox.create({6  networkPolicy: {7    allow: {8      "api.github.com": [{9        match: {10          path: { startsWith: "/v1" },11          method: ["POST"]12        },13        forwardURL: "https://my-custom-proxy.vercel.app/api/proxy"14      }],15      // Allow traffic to all other domains. If unset only defined ones are reachable.16      "*": []17    }18  }19});

These features are available in beta for Pro and Enterprise plans. Get started by installing the @vercel/sandbox@beta SDK, and learn more in the docs about requests proxying and matchers.

Ready to deploy?Start building with a free account. Speak to an expert for your _Pro_ or Enterprise needs.

Start DeployingTalk to an Expert

Explore Vercel Enterprise with an interactive product tour, trial, or a personalized demo.

Explore Enterprise

Get Started

• Templates
• Supported frameworks
• Marketplace
• Domains

Build

• Next.js on Vercel
• Turborepo
• v0

Scale

• Content delivery network
• Fluid compute
• CI/CD
• Observability
• AI Gateway New
• Vercel Agent New

Secure

• Platform security
• Web Application Firewall
• Bot management
• BotID
• Sandbox New

Resources

• Pricing
• Customers
• Enterprise
• Articles
• Startups
• Solution partners

Learn

• Docs
• Blog
• Changelog
• Knowledge Base
• Academy
• Community

Frameworks

• Next.js
• Nuxt
• Svelte
• Nitro
• Turbo

SDKs

• AI SDK
• Workflow SDK New
• Flags SDK
• Chat SDK
• Streamdown AI New

Use Cases

• Composable commerce
• Multi-tenant platforms
• Web apps
• Marketing sites
• Platform engineers
• Design engineers

Company

• About
• Careers
• Help
• Press
• Legal
• Privacy Policy

Community

• Open source program
• Events
• Shipped on Vercel
• GitHub
• LinkedIn
• X
• YouTube

[](https://vercel.com/home)

Loading status…Select a display theme:system light dark