@deepkit/http 1.0.18 → 1.1.0

package/src/http.ts

@@ -27,9 +27,10 @@ export function isElementStruct(v: any): v is ElementStruct {
 
 let templateRender: typeof render;
 
-function getTemplateRender(): typeof render {
+// @deepkit/template is optional, so it's only loaded when a controller returns a JSX element.
+async function getTemplateRender(): Promise<typeof render> {
     if (!templateRender) {
-        const template = require('@deepkit/template');
+        const template = await import('@deepkit/template');
         templateRender = template.render;
     }
 
@@ -110,6 +111,9 @@ export class HttpInternalServerError extends createHttpError(500, 'Internal serv
 export class HttpNotImplementedError extends createHttpError(501, 'Not implemented') {
 }
 
+export class HttpGatewayTimeoutError extends createHttpError(504, 'Gateway timeout') {
+}
+
 export class HttpWorkflowEvent extends BaseEvent {
     public nextState?: any;
     public nextStateEvent?: any;
@@ -318,7 +322,7 @@ export const httpWorkflow = createWorkflow('http', {
 }, {
     start: 'request',
     request: 'route',
-    route: ['auth', 'routeNotFound'],
+    route: ['auth', 'routeNotFound', 'response'],
     auth: ['resolveParameters', 'accessDenied'],
     resolveParameters: ['controller', 'parametersFailed'],
     accessDenied: 'response',
@@ -541,9 +545,9 @@ export class HttpListener {
         protected logger: LoggerInterface,
         protected resultFormatter: HttpResultFormatter,
         protected injector: Injector,
-        protected stopwatch?: Stopwatch,
+        protected stopwatch: Stopwatch,
     ) {
-        this.setRouteConfig = injector.createSetter(RouteConfig, {name: 'http'});
+        this.setRouteConfig = injector.createSetter(RouteConfig, 'http');
     }
 
     @eventDispatcher.listen(httpWorkflow.onRequest, 100)
@@ -559,6 +563,7 @@ export class HttpListener {
         if (event.sent) return;
         if (event.hasNext()) return;
         const logger = this.logger;
+        let inMiddleware = false;
 
         try {
             const resolved = this.router.resolveRequest(event.request);
@@ -570,6 +575,7 @@ export class HttpListener {
                 if (resolved.middlewares) {
                     const middlewares = resolved.middlewares(event.injectorContext);
                     if (middlewares.length) {
+                        inMiddleware = true;
                         await asyncOperation(async (resolve, reject) => {
                             let lastTimer: any = undefined;
 
@@ -581,6 +587,7 @@ export class HttpListener {
 
                             event.response.once('finish', finish);
                             let i = -1;
+                            let timedOut = false;
 
                             async function next() {
                                 i++;
@@ -594,14 +601,18 @@ export class HttpListener {
                                 const timeout = middlewares[i].timeout;
                                 if (timeout !== undefined && timeout > 0) {
                                     lastTimer = setTimeout(() => {
+                                        //a middleware that neither calls next() nor ends the response in time fails the request
+                                        timedOut = true;
                                         logger.warn(`Middleware timed out. Increase the timeout or fix the middleware. (${middlewares[i].fn})`);
-                                        next();
+                                        event.response.off('finish', finish);
+                                        reject(new HttpGatewayTimeoutError('Middleware timed out'));
                                     }, timeout);
                                 }
 
                                 try {
                                     await middlewares[i].fn(event.request, event.response, (error?: any) => {
                                         if (lastTimer) clearTimeout(lastTimer);
+                                        if (timedOut) return;
                                         if (error) {
                                             event.response.off('finish', finish);
                                             reject(error);
@@ -610,19 +621,42 @@ export class HttpListener {
                                         }
                                     });
                                 } catch (error) {
+                                    event.response.off('finish', finish);
                                     reject(error);
                                 }
                             }
 
                             await next();
                         });
+                        inMiddleware = false;
                     }
                 }
 
+                if (event.sent) {
+                    //a middleware ended the request, so we skip the controller but still trigger onResponse (e.g. for logging)
+                    event.next('response', new HttpResponseEvent(event.injectorContext, event.request, event.response, undefined, resolved.routeConfig));
+                    return;
+                }
+
                 this.setRouteConfig(resolved.routeConfig, event.injectorContext.scope);
                 event.routeFound(resolved.routeConfig, resolved.parameters);
             }
         } catch (error) {
+            if (error instanceof HttpError) {
+                if (event.request.throwErrorOnNotFound && error.httpCode === 404) {
+                    throw error;
+                }
+                event.send(new JSONResponse({
+                    message: error.message
+                }, error.httpCode).disableAutoSerializing());
+                return;
+            }
+            if (inMiddleware) {
+                //like a failing controller, an error of a middleware is a server error (#439)
+                this.logger.error('Middleware error', error);
+                event.send(new HtmlResponse('Internal error', 500));
+                return;
+            }
             this.logger.error('Could not resolve request', error);
             event.notFound();
         }
@@ -690,7 +724,7 @@ export class HttpListener {
             ? getClassName(event.route.action.controller) + '.' + event.route.action.methodName
             : event.route.action.fn.name;
 
-        const frame = this.stopwatch ? this.stopwatch.start(stopWatchLabel, FrameCategory.httpController) : undefined;
+        const frame = this.stopwatch.start(stopWatchLabel, FrameCategory.httpController);
         try {
             let result: any;
             if (event.route.action.type === 'controller') {
@@ -702,7 +736,7 @@ export class HttpListener {
             }
 
             if (isElementStruct(result)) {
-                const html = await getTemplateRender()(event.injectorContext.getRootInjector(), result, this.stopwatch ? this.stopwatch : undefined);
+                const html = await (await getTemplateRender())(event.injectorContext.getRootInjector(), result, this.stopwatch ? this.stopwatch : undefined);
                 result = new HtmlResponse(html, 200).header('Content-Type', 'text/html; charset=utf-8');
             }
             if (result instanceof stream.Readable) {
@@ -716,7 +750,6 @@ export class HttpListener {
             responseEvent.controllerActionTime = Date.now() - start;
             event.next('response', responseEvent);
         } catch (error: any) {
-            if (frame) frame.end();
             if (error instanceof HttpAccessDeniedError) {
                 event.next('accessDenied', new HttpAccessDeniedEvent(event.injectorContext, event.request, event.response, event.route, error));
             } else {
@@ -725,7 +758,7 @@ export class HttpListener {
                 event.next('controllerError', errorEvent);
             }
         } finally {
-            if (frame) frame.end();
+            frame.end();
         }
     }
 

package/src/kernel.ts

@@ -2,14 +2,7 @@ import { InjectorContext, Setter } from '@deepkit/injector';
 import { HttpRouter } from './router.js';
 import { EventDispatcher } from '@deepkit/event';
 import { LoggerInterface } from '@deepkit/logger';
-import {
-    HttpRequest,
-    HttpResponse,
-    incomingMessageToHttpRequest,
-    MemoryHttpResponse,
-    RequestBuilder,
-    serverResponseToHttpResponse,
-} from './model.js';
+import { HttpRequest, HttpResponse, incomingMessageToHttpRequest, MemoryHttpResponse, RequestBuilder, serverResponseToHttpResponse } from './model.js';
 import { HttpError, HttpRequestEvent, HttpResultFormatter, httpWorkflow, JSONResponse } from './http.js';
 import { FrameCategory, Stopwatch } from '@deepkit/stopwatch';
 import { unlink } from 'fs';
@@ -43,7 +36,7 @@ export class HttpKernel {
         protected eventDispatcher: EventDispatcher,
         protected injectorContext: InjectorContext,
         protected logger: LoggerInterface,
-        protected stopwatch?: Stopwatch,
+        protected stopwatch: Stopwatch,
     ) {
         this.setHttpRequest = injectorContext.setter(undefined, HttpRequest);
         this.setHttpResponse = injectorContext.setter(undefined, HttpResponse);
@@ -112,16 +105,12 @@ export class HttpKernel {
 
         req.throwErrorOnNotFound = options.throwOnNotFound || false;
 
-        const frame = this.stopwatch ? this.stopwatch.start(req.method + ' ' + req.getUrl(), FrameCategory.http, true) : undefined;
-        const workflow = httpWorkflow.create('start', this.eventDispatcher, httpInjectorContext, this.stopwatch);
+        const frame = this.stopwatch.start(req.method + ' ' + req.getUrl(), FrameCategory.http, true);
+        const workflow = httpWorkflow.create('start', this.eventDispatcher, this.stopwatch, httpInjectorContext);
 
         try {
-            if (frame) {
-                frame.data({ url: req.getUrl(), method: req.getMethod(), clientIp: req.getRemoteAddress() });
-                await frame.run(() => workflow.apply('request', new HttpRequestEvent(httpInjectorContext, req, res)));
-            } else {
-                await workflow.apply('request', new HttpRequestEvent(httpInjectorContext, req, res));
-            }
+            frame.data({ url: req.getUrl(), method: req.getMethod(), clientIp: req.getRemoteAddress() });
+            await frame.run(() => workflow.apply('request', new HttpRequestEvent(httpInjectorContext, req, res)));
         } catch (error: any) {
             if (!res.headersSent) {
                 const resultFormatter = httpInjectorContext.get(HttpResultFormatter);
@@ -151,10 +140,8 @@ export class HttpKernel {
                 });
             }
 
-            if (frame) {
-                frame.data({ responseStatus: res.statusCode });
-                frame.end();
-            }
+            frame.data({ responseStatus: res.statusCode });
+            frame.end();
         }
     }
 }

package/src/middleware.ts

@@ -79,8 +79,8 @@ export class HttpMiddlewareApi {
     }
 
     /**
-     * When the middleware does not respond (either calling next() or sending headers) withing <timeout> milliseconds,
-     * automatically the next is executed and warning printed.
+     * When the middleware neither calls next() nor ends the response within <timeout> milliseconds,
+     * the request fails with HttpGatewayTimeoutError (504) and a warning is logged.
      */
     timeout(timeout: number) {
         this.t.timeout = timeout;

package/src/mime.ts

@@ -0,0 +1,141 @@
+/*
+ * Deepkit Framework
+ * Copyright (C) 2021 Deepkit UG, Marc J. Schmidt
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the MIT License.
+ *
+ * You should have received a copy of the MIT License along with this program.
+ */
+import { extname } from 'path';
+
+/**
+ * File extension to MIME type map of common web types.
+ * Add more types at runtime by setting `mimeTypes[extension] = type`.
+ */
+export const mimeTypes: { [extension: string]: string } = {
+    // text
+    html: 'text/html',
+    htm: 'text/html',
+    css: 'text/css',
+    js: 'text/javascript',
+    mjs: 'text/javascript',
+    cjs: 'application/node',
+    txt: 'text/plain',
+    text: 'text/plain',
+    csv: 'text/csv',
+    tsv: 'text/tab-separated-values',
+    md: 'text/markdown',
+    markdown: 'text/markdown',
+    yaml: 'text/yaml',
+    yml: 'text/yaml',
+    ics: 'text/calendar',
+    vtt: 'text/vtt',
+    appcache: 'text/cache-manifest',
+    // application
+    json: 'application/json',
+    map: 'application/json',
+    jsonld: 'application/ld+json',
+    webmanifest: 'application/manifest+json',
+    xml: 'application/xml',
+    xsl: 'application/xml',
+    rtf: 'application/rtf',
+    wasm: 'application/wasm',
+    pdf: 'application/pdf',
+    zip: 'application/zip',
+    gz: 'application/gzip',
+    tar: 'application/x-tar',
+    bz2: 'application/x-bzip2',
+    '7z': 'application/x-7z-compressed',
+    rar: 'application/vnd.rar',
+    xz: 'application/x-xz',
+    bin: 'application/octet-stream',
+    epub: 'application/epub+zip',
+    doc: 'application/msword',
+    docx: 'application/vnd.openxmlformats-officedocument.wordprocessingml.document',
+    xls: 'application/vnd.ms-excel',
+    xlsx: 'application/vnd.openxmlformats-officedocument.spreadsheetml.sheet',
+    ppt: 'application/vnd.ms-powerpoint',
+    pptx: 'application/vnd.openxmlformats-officedocument.presentationml.presentation',
+    odt: 'application/vnd.oasis.opendocument.text',
+    ods: 'application/vnd.oasis.opendocument.spreadsheet',
+    odp: 'application/vnd.oasis.opendocument.presentation',
+    m3u8: 'application/vnd.apple.mpegurl',
+    mpd: 'application/dash+xml',
+    // images
+    png: 'image/png',
+    apng: 'image/apng',
+    jpg: 'image/jpeg',
+    jpeg: 'image/jpeg',
+    jpe: 'image/jpeg',
+    gif: 'image/gif',
+    webp: 'image/webp',
+    avif: 'image/avif',
+    svg: 'image/svg+xml',
+    svgz: 'image/svg+xml',
+    ico: 'image/vnd.microsoft.icon',
+    bmp: 'image/bmp',
+    tif: 'image/tiff',
+    tiff: 'image/tiff',
+    heic: 'image/heic',
+    heif: 'image/heif',
+    jxl: 'image/jxl',
+    psd: 'image/vnd.adobe.photoshop',
+    // fonts
+    woff: 'font/woff',
+    woff2: 'font/woff2',
+    ttf: 'font/ttf',
+    otf: 'font/otf',
+    eot: 'application/vnd.ms-fontobject',
+    // audio
+    mp3: 'audio/mpeg',
+    m4a: 'audio/mp4',
+    aac: 'audio/aac',
+    oga: 'audio/ogg',
+    ogg: 'audio/ogg',
+    opus: 'audio/ogg',
+    wav: 'audio/wav',
+    flac: 'audio/x-flac',
+    // video
+    mp4: 'video/mp4',
+    m4v: 'video/x-m4v',
+    webm: 'video/webm',
+    ogv: 'video/ogg',
+    mov: 'video/quicktime',
+    avi: 'video/x-msvideo',
+    mkv: 'video/x-matroska',
+    mpeg: 'video/mpeg',
+    mpg: 'video/mpeg',
+    '3gp': 'video/3gpp',
+    ts: 'video/mp2t',
+    // 3d models
+    glb: 'model/gltf-binary',
+    gltf: 'model/gltf+json',
+    obj: 'model/obj',
+    stl: 'model/stl',
+    usdz: 'model/vnd.usdz+zip',
+};
+
+/**
+ * Returns the MIME type for a file path, file name, or extension (with or without leading dot).
+ * Returns undefined for unknown extensions.
+ *
+ * `getMimeType('/assets/logo.svg')` → `image/svg+xml`
+ */
+export function getMimeType(path: string): string | undefined {
+    const extension = extname('x.' + path)
+        .slice(1)
+        .toLowerCase();
+    return Object.prototype.hasOwnProperty.call(mimeTypes, extension) ? mimeTypes[extension] : undefined;
+}
+
+/**
+ * Returns the value for a Content-Type header, including `charset=utf-8` for text types.
+ * Returns undefined for unknown extensions.
+ */
+export function getContentType(path: string): string | undefined {
+    const type = getMimeType(path);
+    if (!type) return;
+    const isText = type.startsWith('text/') || type === 'application/json' || type === 'application/manifest+json';
+    return isText ? type + '; charset=utf-8' : type;
+}

package/src/model.ts

@@ -312,13 +312,21 @@ export class RequestBuilder {
         }, this.contentBuffer);
     }
 
+    /**
+     * Replaces all headers. Names are lowercased like Node does for incoming requests.
+     */
     headers(headers: { [name: string]: string }): this {
-        this._headers = headers;
+        this._headers = {};
+        for (const [name, value] of Object.entries(headers)) this.header(name, value);
         return this;
     }
 
+    /**
+     * Sets a header. The name is lowercased like Node does for incoming requests,
+     * so `header('Authorization', ...)` is found by `authorization: HttpHeader<string>`.
+     */
     header(name: string, value: string | number): this {
-        this._headers[name] = String(value);
+        this._headers[name.toLowerCase()] = String(value);
         return this;
     }
 

package/src/module.ts

@@ -32,8 +32,9 @@ export class HttpModule extends createModuleClass({
         HttpResultFormatter,
         HttpRouterRegistry,
         HttpRouterFilterResolver,
-        { provide: HttpResponse, scope: 'http' },
-        { provide: HttpRequest, scope: 'http' },
+        { provide: InjectorContext, useValue: undefined, scope: 'http' },
+        { provide: HttpResponse, useValue: undefined, scope: 'http' },
+        { provide: HttpRequest, useValue: undefined, scope: 'http' },
         { provide: RouteConfig, useValue: undefined, scope: 'http' },
         { provide: Logger, useValue: new Logger([new ConsoleTransport()]) },
     ],
@@ -49,6 +50,7 @@ export class HttpModule extends createModuleClass({
         HttpKernel,
         HttpResultFormatter,
         HttpRouterFilterResolver,
+        InjectorContext,
         HttpResponse,
         HttpRequest,
         HttpControllers,

package/src/query-string.ts

@@ -0,0 +1,228 @@
+/*
+ * Deepkit Framework
+ * Copyright (C) 2021 Deepkit UG, Marc J. Schmidt
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the MIT License.
+ *
+ * You should have received a copy of the MIT License along with this program.
+ */
+
+/**
+ * Query string parser compatible with the default behavior of `qs.parse`.
+ *
+ * Supports nested objects (`a[b]=1`), arrays (`a[]=1`, `a[0]=1`) and duplicate keys (`a=1&a=2` becomes an array).
+ *
+ * Limits:
+ * - at most 1000 parameters are parsed, the rest is ignored
+ * - at most 5 levels of nesting, the remainder is used as literal key (`a[b][c][d][e][f][g]` → `a.b.c.d.e.f['[g]']`)
+ * - array indices above 20 create object keys instead of sparse arrays (`a[100]=1` → `{a: {100: '1'}}`)
+ *
+ * Keys that exist on Object.prototype (`__proto__`, `constructor`, `toString`, `hasOwnProperty`, ...) are dropped.
+ */
+const parameterLimit = 1000;
+const depthLimit = 5;
+const arrayLimit = 20;
+
+const has = Object.prototype.hasOwnProperty;
+const isArray = Array.isArray;
+
+function decode(str: string): string {
+    if (str.indexOf('+') !== -1) str = str.replace(/\+/g, ' ');
+    if (str.indexOf('%') === -1) return str;
+    try {
+        return decodeURIComponent(str);
+    } catch {
+        return str;
+    }
+}
+
+/**
+ * Query strings without brackets, the common case: `a=1&b=2&a=3` → `{a: ['1', '3'], b: '2'}`.
+ * Same result as the general parser, without its nesting and compaction steps.
+ */
+function parseFlat(str: string): Record<string, any> {
+    const obj: Record<string, any> = {};
+    for (const part of str.split('&', parameterLimit)) {
+        const pos = part.indexOf('=');
+        const key = decode(pos === -1 ? part : part.slice(0, pos));
+        if (!key || has.call(Object.prototype, key)) continue;
+        const val = pos === -1 ? '' : decode(part.slice(pos + 1));
+        obj[key] = has.call(obj, key) ? ([] as any[]).concat(obj[key], val) : val;
+    }
+    return obj;
+}
+
+const nesting = /[[\]]|%5[bd]/i;
+
+function parseValues(str: string): Record<string, any> {
+    const obj: Record<string, any> = Object.create(null);
+    const parts = str.replace(/%5B/gi, '[').replace(/%5D/gi, ']').split('&', parameterLimit);
+
+    for (const part of parts) {
+        const bracketEqualsPos = part.indexOf(']=');
+        const pos = bracketEqualsPos === -1 ? part.indexOf('=') : bracketEqualsPos + 1;
+
+        const key = decode(pos === -1 ? part : part.slice(0, pos));
+        const val = pos === -1 ? '' : decode(part.slice(pos + 1));
+
+        obj[key] = has.call(obj, key) ? ([] as any[]).concat(obj[key], val) : val;
+    }
+
+    return obj;
+}
+
+function parseObject(chain: string[], val: any): any {
+    let leaf = val;
+
+    for (let i = chain.length - 1; i >= 0; --i) {
+        let obj: any;
+        const root = chain[i];
+
+        if (root === '[]') {
+            obj = ([] as any[]).concat(leaf);
+        } else {
+            obj = {};
+            const cleanRoot = root.charAt(0) === '[' && root.charAt(root.length - 1) === ']' ? root.slice(1, -1) : root;
+            const index = parseInt(cleanRoot, 10);
+            if (
+                !isNaN(index) &&
+                root !== cleanRoot &&
+                String(index) === cleanRoot &&
+                index >= 0 &&
+                index <= arrayLimit
+            ) {
+                obj = [];
+                obj[index] = leaf;
+            } else if (cleanRoot !== '__proto__') {
+                obj[cleanRoot] = leaf;
+            }
+        }
+
+        leaf = obj;
+    }
+
+    return leaf;
+}
+
+function parseKeys(key: string, val: any): any {
+    if (!key) return;
+
+    const brackets = /(\[[^[\]]*])/;
+    const child = /(\[[^[\]]*])/g;
+
+    let segment = brackets.exec(key);
+    const parent = segment ? key.slice(0, segment.index) : key;
+
+    const keys: string[] = [];
+    if (parent) {
+        if (has.call(Object.prototype, parent)) return;
+        keys.push(parent);
+    }
+
+    let i = 0;
+    while ((segment = child.exec(key)) !== null && i < depthLimit) {
+        i += 1;
+        if (has.call(Object.prototype, segment[1].slice(1, -1))) return;
+        keys.push(segment[1]);
+    }
+
+    // depth limit reached, the remainder is used as literal key
+    if (segment) keys.push('[' + key.slice(segment.index) + ']');
+
+    return parseObject(keys, val);
+}
+
+function arrayToObject(source: any[]): Record<string, any> {
+    const obj: Record<string, any> = {};
+    for (let i = 0; i < source.length; ++i) {
+        if (source[i] !== undefined) obj[i] = source[i];
+    }
+    return obj;
+}
+
+function merge(target: any, source: any): any {
+    if (!source) return target;
+
+    if (typeof source !== 'object') {
+        if (isArray(target)) {
+            target.push(source);
+        } else if (target && typeof target === 'object') {
+            if (!has.call(Object.prototype, source)) target[source] = true;
+        } else {
+            return [target, source];
+        }
+        return target;
+    }
+
+    if (!target || typeof target !== 'object') {
+        return [target].concat(source);
+    }
+
+    if (isArray(target) && isArray(source)) {
+        source.forEach((item, i) => {
+            if (has.call(target, i)) {
+                const targetItem = target[i];
+                if (targetItem && typeof targetItem === 'object' && item && typeof item === 'object') {
+                    target[i] = merge(targetItem, item);
+                } else {
+                    target.push(item);
+                }
+            } else {
+                target[i] = item;
+            }
+        });
+        return target;
+    }
+
+    const mergeTarget = isArray(target) && !isArray(source) ? arrayToObject(target) : target;
+    for (const key of Object.keys(source)) {
+        mergeTarget[key] = has.call(mergeTarget, key) ? merge(mergeTarget[key], source[key]) : source[key];
+    }
+    return mergeTarget;
+}
+
+/**
+ * Removes holes from (sparse) arrays, e.g. `a[1]=x` results in `['x']`, not `[undefined, 'x']`.
+ */
+function compact(value: Record<string, any>): Record<string, any> {
+    const queue: { obj: any; prop: string }[] = [{ obj: { o: value }, prop: 'o' }];
+    const refs: any[] = [];
+
+    for (let i = 0; i < queue.length; ++i) {
+        const obj = queue[i].obj[queue[i].prop];
+        for (const key of Object.keys(obj)) {
+            const val = obj[key];
+            if (typeof val === 'object' && val !== null && refs.indexOf(val) === -1) {
+                queue.push({ obj, prop: key });
+                refs.push(val);
+            }
+        }
+    }
+
+    while (queue.length > 1) {
+        const item = queue.pop()!;
+        const obj = item.obj[item.prop];
+        if (isArray(obj)) item.obj[item.prop] = obj.filter(v => v !== undefined);
+    }
+
+    return value;
+}
+
+/**
+ * Parses a query string (without leading `?`) into an object.
+ *
+ * `a=1&b[c]=2&d[]=3&d[]=4` → `{a: '1', b: {c: '2'}, d: ['3', '4']}`
+ */
+export function parseQueryString(str: string): Record<string, any> {
+    if (!str) return {};
+    if (!nesting.test(str)) return parseFlat(str);
+
+    const values = parseValues(str);
+    let obj: Record<string, any> = {};
+    for (const key of Object.keys(values)) {
+        obj = merge(obj, parseKeys(key, values[key]));
+    }
+
+    return compact(obj);
+}

package/src/request-parser.ts

@@ -19,7 +19,7 @@ import {
 } from '@deepkit/type';
 import { BodyValidationError, createRequestWithCachedBody, getRegExp, HttpRequest, ValidatedBody } from './model.js';
 import { getRouteActionLabel, RouteConfig, UploadedFile, UploadedFileSymbol } from './router.js';
-import qs from 'qs';
+import { parseQueryString } from './query-string.js';
 import formidable, { Fields, Files, Options } from 'formidable';
 import { HttpParserOptions } from './module.config.js';
 import type IncomingForm from 'formidable/Formidable.js';
@@ -231,10 +231,10 @@ export function buildRequestParser(parseOptions: HttpParserOptions, parameters:
         routeConfig
     });
     compiler.context.set('ValidationError', ValidationError);
-    compiler.context.set('qs', qs);
+    compiler.context.set('parseQueryString', parseQueryString);
 
     let needsQueryString = !!params.find(v => v.query || v.queries || v.requestParser);
-    const query = needsQueryString ? '_qPosition === -1 ? {} : qs.parse(_url.substr(_qPosition + 1))' : '{}';
+    const query = needsQueryString ? '_qPosition === -1 ? {} : parseQueryString(_url.substr(_qPosition + 1))' : '{}';
 
     const regexVar = compiler.reserveVariable('regex', new RegExp('^' + pathRegex + '$'));
 
@@ -329,7 +329,9 @@ export function getRequestParserCodeForParameters(
 
             const queryPath = parameter.typePath === undefined && !parameter.queries ? parameter.parameter.name : parameter.typePath;
             const accessor = queryPath ? `['` + (queryPath.replace(/\./g, `']['`)) + `']` : '';
-            const queryAccessor = parameter.header ? `_headers${accessor}` : queryPath ? `_query${accessor}` : '_query';
+            // header names are case-insensitive, Node lowercases them in request.headers
+            const headerAccessor = queryPath ? `_headers[${JSON.stringify(queryPath.toLowerCase())}]` : '_headers';
+            const queryAccessor = parameter.header ? headerAccessor : queryPath ? `_query${accessor}` : '_query';
 
             if (isOptional(parameter.parameter.parameter) || hasDefaultValue(parameter.parameter.parameter)) {
                 setParameters.push(`parameters.${parameter.parameter.name} = ${queryAccessor} === undefined ? undefined : ${converterVar}(${queryAccessor}, {loosely: true});`);