feat(runtime): support auth headers and additional fetch options when loading remote modules

[smeng9]

Description

A compliance requirement in the backend gateway needs an Authorization: Bearer … header (plus arbitrary X-* headers) for loading remote modules. Previously all assets that are fetched with no authorization header will be rejected under new access control model.

This PR adds per-remote fetchOptions so federated ESM/module remotes can be loaded with custom HTTP headers on their manifest, remote entry, split chunks, shared deps, and CSS requests.

  mf.registerRemotes(
    [{ name, entry, type: 'module' }],
    { fetchOptions: { headers: { Authorization: `Bearer ${token}` } } },
  );

Related Issue

Multiple people had requested this feature before
module-federation/utilities#13
module-federation/enhanced#21

Additionally previous discussions are outdated,
they involve webpack require() instead of esm import()
#1115

Types of changes

• Docs change / refactoring / dependency upgrade
• Bug fix (non-breaking change which fixes an issue)
• New feature (non-breaking change which adds functionality)

Checklist

• I have added tests to cover my changes.
• All new and existing tests passed.
• I have updated the documentation.

[changeset-bot]

🦋 Changeset detected

Latest commit: f9438b0

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 46 packages

Name	Type
@module-federation/runtime-core	Major
@module-federation/sdk	Major
@module-federation/nextjs-mf	Patch
@module-federation/runtime	Major
@module-federation/bridge-react	Major
@module-federation/devtools	Major
@module-federation/cli	Major
@module-federation/dts-plugin	Major
@module-federation/enhanced	Major
@module-federation/esbuild	Patch
@module-federation/managers	Major
@module-federation/manifest	Major
@module-federation/metro	Major
@module-federation/modern-js-v3	Major
@module-federation/modern-js	Major
@module-federation/node	Patch
@module-federation/observability-plugin	Patch
@module-federation/retry-plugin	Major
@module-federation/rsbuild-plugin	Major
@module-federation/rspack	Major
@module-federation/rspress-plugin	Major
@module-federation/storybook-addon	Major
@module-federation/utilities	Patch
@module-federation/webpack-bundler-runtime	Major
@module-federation/bridge-react-webpack-plugin	Major
@module-federation/bridge-vue3	Major
@module-federation/runtime-tools	Major
shared-tree-shaking-no-server-host	Patch
shared-tree-shaking-no-server-provider	Patch
@module-federation/metro-plugin-rnc-cli	Major
@module-federation/metro-plugin-rnef	Major
@module-federation/metro-plugin-rock	Major
shared-tree-shaking-with-server-host	Patch
shared-tree-shaking-with-server-provider	Patch
node-dynamic-remote-new-version	Patch
node-dynamic-remote	Patch
remote5	Patch
remote6	Patch
website-new	Patch
@module-federation/inject-external-runtime-core-plugin	Major
@module-federation/third-party-dts-extractor	Major
@module-federation/bridge-shared	Major
@module-federation/error-codes	Major
create-module-federation	Major
@module-federation/treeshake-server	Major
@module-federation/treeshake-frontend	Major

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

[netlify]

✅ Deploy Preview for module-federation-docs ready!

Name	Link
🔨 Latest commit	f9438b0
🔍 Latest deploy log	https://app.netlify.com/projects/module-federation-docs/deploys/6a3a0ee7a1af75000835c900
😎 Deploy Preview	https://deploy-preview-4827--module-federation-docs.netlify.app
📱 Preview on mobile	Toggle QR Code... Use your smartphone camera to open QR code link.
🤖 Make changes	Run an agent on this branch

---

To edit notification comments on pull requests, go to your Netlify project configuration.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: e3686009e9

ℹ️ About Codex in GitHub

Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".

[2heal1]

The ESM loading direction makes sense, but I don't think fetchOptions should be added to registerRemote/registerRemotes.

The runtime already has a fetch hook, and manifest loading already uses that hook with remoteInfo. Header/auth customization is request behavior, so keeping it in the existing fetch lifecycle is more consistent than adding a second configuration path on remote registration.

This also avoids expanding the public remote config API. Users can already decide headers based on remoteInfo in the hook, which also works better for dynamic cases such as token refresh or per-request auth logic.

So I think the change should keep remote registration unchanged, and make ESM remote entry / related ESM asset loading go through the existing fetch hook with remoteInfo.

[smeng9]

Hi @2heal1

I have applied your suggestions to keep the function signature the same for registerRemotes.

Would you mind take another look? Thanks!