@antelopejs/dms-frontend 0.3.6 → 0.3.7

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@antelopejs/dms-frontend",
-  "version": "0.3.6",
+  "version": "0.3.7",
   "description": "Frontend-agnostic loader for AntelopeJS DMS, shipping the Vue 3 renderer (Vite, Inertia, SSR)",
   "keywords": [
     "antelope",

package/templates/vue/server/client-error.mjs

@@ -0,0 +1,41 @@
+// Answers for requests Node rejects before the request handler runs. Without
+// a `clientError` listener Node answers on its own and logs nothing, so a page
+// refused for its headers left no trace in the server output.
+
+const HEADER_OVERFLOW = "HPE_HEADER_OVERFLOW";
+const HEADER_OVERFLOW_RESPONSE =
+  "HTTP/1.1 431 Request Header Fields Too Large\r\nConnection: close\r\n\r\n";
+const BAD_REQUEST_RESPONSE =
+  "HTTP/1.1 400 Bad Request\r\nConnection: close\r\n\r\n";
+// A browser retries a refused page with the same cookies: one hint per minute
+// is enough to explain them all.
+const HEADER_OVERFLOW_HINT_INTERVAL_MS = 60_000;
+
+let lastHeaderOverflowHint = -Infinity;
+
+function warnHeaderOverflow(maxHeaderSize) {
+  const now = Date.now();
+  if (now - lastHeaderOverflowHint < HEADER_OVERFLOW_HINT_INTERVAL_MS) return;
+  lastHeaderOverflowHint = now;
+  console.warn(
+    `DMS refused a request with 431: its headers exceed the ${maxHeaderSize}-byte limit. ` +
+      "This is most often cookies accumulated on this host (browsers share " +
+      "localhost cookies across ports); clear this site's cookies and reload.",
+  );
+}
+
+/**
+ * The server's `clientError` listener: explains a 431 in the logs, and
+ * otherwise answers as Node does without a listener.
+ */
+export function handleClientError(error, socket, maxHeaderSize) {
+  let response = BAD_REQUEST_RESPONSE;
+  if (error.code === HEADER_OVERFLOW) {
+    response = HEADER_OVERFLOW_RESPONSE;
+    warnHeaderOverflow(maxHeaderSize);
+  }
+  // Once a response went out on this connection, a status line would land in
+  // the middle of it.
+  if (socket.writable && socket.bytesWritten === 0) socket.write(response);
+  socket.destroy();
+}

package/templates/vue/server.mjs

@@ -1,5 +1,5 @@
 import { createReadStream, existsSync, readFileSync, statSync } from "node:fs";
-import { createServer } from "node:http";
+import { createServer, maxHeaderSize } from "node:http";
 import { extname, join, resolve, sep } from "node:path";
 import { Readable } from "node:stream";
 import { pipeline } from "node:stream/promises";
@@ -19,6 +19,7 @@ import {
   redirectAccessRefusal,
   UNEXPECTED_ERROR_BODY,
 } from "./server/backend-response.mjs";
+import { handleClientError } from "./server/client-error.mjs";
 import { productionHtmlTemplate } from "./server/client-manifest.mjs";
 import { writeContent } from "./server/content.mjs";
 import {
@@ -489,6 +490,9 @@ if (
   import.meta.url === new URL(`file://${process.argv[1]}`).href
 ) {
   frontendHttpServer = createServer(handleRequestSafely);
+  frontendHttpServer.on("clientError", (error, socket) =>
+    handleClientError(error, socket, maxHeaderSize),
+  );
   frontendHttpServer.listen(
     Number(process.env.PORT ?? 3001),
     process.env.HOST ?? "0.0.0.0",