@fastify/reply-from 12.5.0 → 12.6.1

package/LICENSE

@@ -1,9 +1,7 @@
 MIT License
 
 Copyright (c) 2017-present Matteo Collina
-Copyright (c) 2017-present The Fastify team
-
-The Fastify team members are listed at https://github.com/fastify/fastify#team.
+Copyright (c) 2017-present The Fastify team <https://github.com/fastify/fastify#team>
 
 Permission is hereby granted, free of charge, to any person obtaining a copy
 of this software and associated documentation files (the "Software"), to deal

package/README.md

@@ -66,10 +66,10 @@ target.listen({ port: 3001 }, (err) => {
 Set the base URL for all the forwarded requests. Will be required if `http2` is set to `true`
 Note that _every path will be discarded_.
 
-Set the base URL for all the forwarded requests.  
-*String or String[]*:  
+Set the base URL for all the forwarded requests.
+*String or String[]*:
 
-* **Single string** → a normal `undici.Pool` / `http.request` client is used.  
+* **Single string** → a normal `undici.Pool` / `http.request` client is used.
 * **Array with ≥ 2 elements** → **[`undici.BalancedPool`](https://undici.nodejs.org/#/docs/api/BalancedPool)** is automatically selected and requests are load-balanced round-robin across the given origins.
 
 When you provide an array, only the *origin* (`protocol://host:port`) part of each URL is considered; any path component is ignored.

package/index.js

@@ -250,11 +250,13 @@ const fastifyReplyFrom = fp(function from (fastify, opts, next) {
 
 function getQueryString (search, reqUrl, opts, request) {
   if (typeof opts.queryString === 'function') {
-    return '?' + opts.queryString(search, reqUrl, request)
+    const qs = opts.queryString(search, reqUrl, request)
+    return qs ? '?' + qs : ''
   }
 
   if (opts.queryString) {
-    return '?' + querystring.stringify(opts.queryString)
+    const qs = querystring.stringify(opts.queryString)
+    return qs ? '?' + qs : ''
   }
 
   if (search.length > 0) {

package/lib/request.js

@@ -5,7 +5,7 @@ const querystring = require('node:querystring')
 const eos = require('end-of-stream')
 const { pipeline } = require('node:stream')
 const undici = require('undici')
-const { stripHttp1ConnectionHeaders } = require('./utils')
+const { stripHttp1ConnectionHeaders, getConnectionHeaders } = require('./utils')
 const http2 = require('node:http2')
 
 const {
@@ -53,7 +53,7 @@ function buildRequest (opts) {
   const isBalanced = Array.isArray(opts.base) && opts.base.length > 1
   const undiciOpts = opts.undici || {}
   const globalAgent = opts.globalAgent
-  const destroyAgent = opts.destroyAgent
+  const destroyAgent = opts.destroyAgent || false
   let http2Client
   let undiciAgent
   let undiciInstance
@@ -104,6 +104,11 @@ function buildRequest (opts) {
   }
 
   function close () {
+    // Always destroy http2 client (internal implementation detail)
+    if (http2Client) {
+      http2Client.destroy()
+    }
+
     if (globalAgent || destroyAgent === false) {
       return
     }
@@ -114,18 +119,28 @@ function buildRequest (opts) {
     } else if (!isHttp2) {
       agents['http:'].destroy()
       agents['https:'].destroy()
-    } else if (http2Client) {
-      http2Client.destroy()
     }
   }
 
   function handleHttp1Req (opts, done) {
+    // Strip Connection header and headers listed in it (RFC 7230 Section 6.1)
+    // Headers are already lowercased by Node.js
+    const connectionHeaderNames = getConnectionHeaders(opts.headers)
+    let headers = opts.headers
+    if (opts.headers.connection || connectionHeaderNames.length > 0) {
+      headers = { ...opts.headers }
+      delete headers.connection
+      for (let i = 0; i < connectionHeaderNames.length; i++) {
+        delete headers[connectionHeaderNames[i]]
+      }
+    }
+
     const req = requests[opts.url.protocol].request({
       method: opts.method,
       port: opts.url.port,
       path: opts.url.pathname + opts.qs,
       hostname: opts.url.hostname,
-      headers: opts.headers,
+      headers,
       agent: agents[opts.url.protocol.replace(/^unix:/, '')],
       ...httpOpts.requestOptions,
       timeout: opts.timeout ?? httpOpts.requestOptions.timeout
@@ -171,10 +186,19 @@ function buildRequest (opts) {
       pool = undiciAgent
     }
 
+    // Strip headers listed in Connection header (RFC 7230 Section 6.1)
+    // Headers are already lowercased
+    const connectionHeaderNames = getConnectionHeaders(req.headers)
+
     // remove forbidden headers
     req.headers.connection = undefined
     req.headers['transfer-encoding'] = undefined
 
+    // Also remove headers listed in Connection header
+    for (let i = 0; i < connectionHeaderNames.length; i++) {
+      req.headers[connectionHeaderNames[i]] = undefined
+    }
+
     pool.request(req, function (err, res) {
       if (err) {
         done(err)

package/lib/utils.js

@@ -28,10 +28,36 @@ function copyHeaders (headers, reply) {
   }
 }
 
+// Parse Connection header and return list of header names to strip (per RFC 7230 Section 6.1)
+function getConnectionHeaders (headers) {
+  const connectionHeader = headers.connection
+  if (typeof connectionHeader !== 'string') {
+    return []
+  }
+  // Connection header is comma-separated list of header names
+  const lowerCased = connectionHeader.toLowerCase()
+  const result = []
+  let start = 0
+  let end = 0
+  for (; end <= lowerCased.length; end++) {
+    if (lowerCased.charCodeAt(end) === 44 || end === lowerCased.length) { // 44 = ','
+      const token = lowerCased.slice(start, end).trim()
+      if (token.length > 0) {
+        result.push(token)
+      }
+      start = end + 1
+    }
+  }
+  return result
+}
+
 function stripHttp1ConnectionHeaders (headers) {
   const headersKeys = Object.keys(headers)
   const dest = {}
 
+  // Get headers listed in Connection header that should be stripped (RFC 7230 Section 6.1)
+  const connectionHeaderNames = getConnectionHeaders(headers)
+
   let header
   let i
 
@@ -54,7 +80,10 @@ function stripHttp1ConnectionHeaders (headers) {
         }
         break
       default:
-        dest[header] = headers[header]
+        // Also skip headers listed in Connection header (RFC 7230 Section 6.1)
+        if (!connectionHeaderNames.includes(header)) {
+          dest[header] = headers[header]
+        }
         break
     }
   }
@@ -96,6 +125,7 @@ function buildURL (source, reqBase) {
 module.exports = {
   copyHeaders,
   stripHttp1ConnectionHeaders,
+  getConnectionHeaders,
   filterPseudoHeaders,
   buildURL
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@fastify/reply-from",
-  "version": "12.5.0",
+  "version": "12.6.1",
   "description": "forward your HTTP request to another server, for fastify",
   "main": "index.js",
   "type": "commonjs",
@@ -60,10 +60,10 @@
   "devDependencies": {
     "@fastify/formbody": "^8.0.0",
     "@fastify/multipart": "^9.0.0",
-    "@sinonjs/fake-timers": "^14.0.0",
-    "@types/node": "^24.0.8",
+    "@sinonjs/fake-timers": "^15.0.0",
+    "@types/node": "^25.0.3",
     "@types/tap": "^18.0.0",
-    "c8": "^10.1.3",
+    "c8": "^11.0.0",
     "eslint": "^9.17.0",
     "fastify": "^5.0.0",
     "form-data": "^4.0.0",

package/test/core-with-path-in-base.test.js

@@ -9,14 +9,14 @@ const http = require('node:http')
 const instance = Fastify()
 
 t.test('core with path in base', async (t) => {
-  t.plan(8)
+  t.plan(7)
   t.after(() => instance.close())
 
   const target = http.createServer((req, res) => {
     t.assert.ok('request proxied')
     t.assert.strictEqual(req.method, 'GET')
     t.assert.strictEqual(req.url, '/hello')
-    t.assert.strictEqual(req.headers.connection, 'close')
+    // Connection header is not forwarded per RFC 7230 Section 6.1
     res.statusCode = 205
     res.setHeader('Content-Type', 'text/plain')
     res.setHeader('x-my-header', 'hello!')

package/test/full-querystring-rewrite-option-empty-object.test.js

@@ -0,0 +1,41 @@
+'use strict'
+
+const t = require('node:test')
+const Fastify = require('fastify')
+const { request } = require('undici')
+const From = require('..')
+const http = require('node:http')
+
+const instance = Fastify()
+
+t.test('queryString empty object should not append trailing ?', async (t) => {
+  t.plan(4)
+  t.after(() => instance.close())
+
+  const target = http.createServer((req, res) => {
+    t.assert.ok('request proxied')
+    t.assert.strictEqual(req.url, '/world')
+    res.statusCode = 200
+    res.setHeader('Content-Type', 'text/plain')
+    res.end('hello world')
+  })
+
+  instance.get('/hello', (_request, reply) => {
+    reply.from(`http://localhost:${target.address().port}/world`, {
+      queryString: {}
+    })
+  })
+
+  t.after(() => target.close())
+
+  await new Promise(resolve => target.listen({ port: 0 }, resolve))
+
+  instance.register(From)
+
+  await new Promise(resolve => instance.listen({ port: 0 }, resolve))
+
+  const result = await request(`http://localhost:${instance.server.address().port}/hello`)
+
+  t.assert.strictEqual(result.statusCode, 200)
+  t.assert.strictEqual(await result.body.text(), 'hello world')
+})

package/test/full-querystring-rewrite-option-function-empty.test.js

@@ -0,0 +1,43 @@
+'use strict'
+
+const t = require('node:test')
+const Fastify = require('fastify')
+const { request } = require('undici')
+const From = require('..')
+const http = require('node:http')
+
+const instance = Fastify()
+
+t.test('queryString function returning empty string should not append trailing ?', async (t) => {
+  t.plan(4)
+  t.after(() => instance.close())
+
+  const target = http.createServer((req, res) => {
+    t.assert.ok('request proxied')
+    t.assert.strictEqual(req.url, '/world')
+    res.statusCode = 200
+    res.setHeader('Content-Type', 'text/plain')
+    res.end('hello world')
+  })
+
+  instance.get('/hello', (_request, reply) => {
+    reply.from(`http://localhost:${target.address().port}/world`, {
+      queryString () {
+        return ''
+      }
+    })
+  })
+
+  t.after(() => target.close())
+
+  await new Promise(resolve => target.listen({ port: 0 }, resolve))
+
+  instance.register(From)
+
+  await new Promise(resolve => instance.listen({ port: 0 }, resolve))
+
+  const result = await request(`http://localhost:${instance.server.address().port}/hello`)
+
+  t.assert.strictEqual(result.statusCode, 200)
+  t.assert.strictEqual(await result.body.text(), 'hello world')
+})

package/test/strip-connection-headers.test.js

@@ -0,0 +1,232 @@
+'use strict'
+
+const t = require('node:test')
+const Fastify = require('fastify')
+const From = require('..')
+const http = require('node:http')
+
+// RFC 7230 Section 6.1 - Connection header handling
+// A proxy MUST parse the Connection header and remove any headers listed within it
+
+// Helper to make HTTP request with Connection header (undici doesn't allow this)
+function makeRequest (port, headers) {
+  return new Promise((resolve, reject) => {
+    const req = http.request({
+      method: 'GET',
+      hostname: 'localhost',
+      port,
+      path: '/',
+      headers
+    }, (res) => {
+      let data = ''
+      res.on('data', (chunk) => { data += chunk })
+      res.on('end', () => resolve({ statusCode: res.statusCode, body: data }))
+    })
+    req.on('error', reject)
+    req.end()
+  })
+}
+
+t.test('strips headers listed in Connection header (undici)', async (t) => {
+  t.plan(4)
+  const instance = Fastify()
+  instance.register(From)
+
+  t.after(() => instance.close())
+
+  const target = http.createServer((req, res) => {
+    t.assert.ok('request proxied')
+    t.assert.strictEqual(req.headers['x-custom-header'], undefined, 'X-Custom-Header should be stripped')
+    res.statusCode = 200
+    res.setHeader('Content-Type', 'text/plain')
+    res.end('ok')
+  })
+
+  instance.get('/', (_request, reply) => {
+    reply.from(`http://localhost:${target.address().port}`)
+  })
+
+  t.after(() => target.close())
+
+  await new Promise((resolve) => instance.listen({ port: 0 }, resolve))
+  await new Promise((resolve) => target.listen({ port: 0 }, resolve))
+
+  const result = await makeRequest(instance.server.address().port, {
+    'X-Custom-Header': 'some-value',
+    Connection: 'X-Custom-Header'
+  })
+
+  t.assert.strictEqual(result.statusCode, 200)
+  t.assert.strictEqual(result.body, 'ok')
+})
+
+t.test('strips multiple headers listed in Connection header (undici)', async (t) => {
+  t.plan(5)
+  const instance = Fastify()
+  instance.register(From)
+
+  t.after(() => instance.close())
+
+  const target = http.createServer((req, res) => {
+    t.assert.ok('request proxied')
+    t.assert.strictEqual(req.headers['x-custom-one'], undefined, 'X-Custom-One should be stripped')
+    t.assert.strictEqual(req.headers['x-custom-two'], undefined, 'X-Custom-Two should be stripped')
+    res.statusCode = 200
+    res.setHeader('Content-Type', 'text/plain')
+    res.end('ok')
+  })
+
+  instance.get('/', (_request, reply) => {
+    reply.from(`http://localhost:${target.address().port}`)
+  })
+
+  t.after(() => target.close())
+
+  await new Promise((resolve) => instance.listen({ port: 0 }, resolve))
+  await new Promise((resolve) => target.listen({ port: 0 }, resolve))
+
+  const result = await makeRequest(instance.server.address().port, {
+    'X-Custom-One': 'value1',
+    'X-Custom-Two': 'value2',
+    Connection: 'X-Custom-One, X-Custom-Two'
+  })
+
+  t.assert.strictEqual(result.statusCode, 200)
+  t.assert.strictEqual(result.body, 'ok')
+})
+
+t.test('preserves headers not listed in Connection header (undici)', async (t) => {
+  t.plan(5)
+  const instance = Fastify()
+  instance.register(From)
+
+  t.after(() => instance.close())
+
+  const target = http.createServer((req, res) => {
+    t.assert.ok('request proxied')
+    t.assert.strictEqual(req.headers['x-keep-header'], 'keep-me', 'X-Keep-Header should be preserved')
+    t.assert.strictEqual(req.headers['x-strip-header'], undefined, 'X-Strip-Header should be stripped')
+    res.statusCode = 200
+    res.setHeader('Content-Type', 'text/plain')
+    res.end('ok')
+  })
+
+  instance.get('/', (_request, reply) => {
+    reply.from(`http://localhost:${target.address().port}`)
+  })
+
+  t.after(() => target.close())
+
+  await new Promise((resolve) => instance.listen({ port: 0 }, resolve))
+  await new Promise((resolve) => target.listen({ port: 0 }, resolve))
+
+  const result = await makeRequest(instance.server.address().port, {
+    'X-Keep-Header': 'keep-me',
+    'X-Strip-Header': 'strip-me',
+    Connection: 'X-Strip-Header'
+  })
+
+  t.assert.strictEqual(result.statusCode, 200)
+  t.assert.strictEqual(result.body, 'ok')
+})
+
+t.test('strips headers listed in Connection header (http)', async (t) => {
+  t.plan(4)
+  const instance = Fastify()
+  instance.register(From, { undici: false })
+
+  t.after(() => instance.close())
+
+  const target = http.createServer((req, res) => {
+    t.assert.ok('request proxied')
+    t.assert.strictEqual(req.headers['x-custom-header'], undefined, 'X-Custom-Header should be stripped')
+    res.statusCode = 200
+    res.setHeader('Content-Type', 'text/plain')
+    res.end('ok')
+  })
+
+  instance.get('/', (_request, reply) => {
+    reply.from(`http://localhost:${target.address().port}`)
+  })
+
+  t.after(() => target.close())
+
+  await new Promise((resolve) => instance.listen({ port: 0 }, resolve))
+  await new Promise((resolve) => target.listen({ port: 0 }, resolve))
+
+  const result = await makeRequest(instance.server.address().port, {
+    'X-Custom-Header': 'some-value',
+    Connection: 'X-Custom-Header'
+  })
+
+  t.assert.strictEqual(result.statusCode, 200)
+  t.assert.strictEqual(result.body, 'ok')
+})
+
+t.test('strips multiple headers listed in Connection header (http)', async (t) => {
+  t.plan(5)
+  const instance = Fastify()
+  instance.register(From, { undici: false })
+
+  t.after(() => instance.close())
+
+  const target = http.createServer((req, res) => {
+    t.assert.ok('request proxied')
+    t.assert.strictEqual(req.headers['x-custom-one'], undefined, 'X-Custom-One should be stripped')
+    t.assert.strictEqual(req.headers['x-custom-two'], undefined, 'X-Custom-Two should be stripped')
+    res.statusCode = 200
+    res.setHeader('Content-Type', 'text/plain')
+    res.end('ok')
+  })
+
+  instance.get('/', (_request, reply) => {
+    reply.from(`http://localhost:${target.address().port}`)
+  })
+
+  t.after(() => target.close())
+
+  await new Promise((resolve) => instance.listen({ port: 0 }, resolve))
+  await new Promise((resolve) => target.listen({ port: 0 }, resolve))
+
+  const result = await makeRequest(instance.server.address().port, {
+    'X-Custom-One': 'value1',
+    'X-Custom-Two': 'value2',
+    Connection: 'X-Custom-One, X-Custom-Two'
+  })
+
+  t.assert.strictEqual(result.statusCode, 200)
+  t.assert.strictEqual(result.body, 'ok')
+})
+
+t.test('handles Connection header with keep-alive and custom headers (undici)', async (t) => {
+  t.plan(4)
+  const instance = Fastify()
+  instance.register(From)
+
+  t.after(() => instance.close())
+
+  const target = http.createServer((req, res) => {
+    t.assert.ok('request proxied')
+    t.assert.strictEqual(req.headers['x-custom-header'], undefined, 'X-Custom-Header should be stripped')
+    res.statusCode = 200
+    res.setHeader('Content-Type', 'text/plain')
+    res.end('ok')
+  })
+
+  instance.get('/', (_request, reply) => {
+    reply.from(`http://localhost:${target.address().port}`)
+  })
+
+  t.after(() => target.close())
+
+  await new Promise((resolve) => instance.listen({ port: 0 }, resolve))
+  await new Promise((resolve) => target.listen({ port: 0 }, resolve))
+
+  const result = await makeRequest(instance.server.address().port, {
+    'X-Custom-Header': 'some-value',
+    Connection: 'keep-alive, X-Custom-Header'
+  })
+
+  t.assert.strictEqual(result.statusCode, 200)
+  t.assert.strictEqual(result.body, 'ok')
+})

package/test/undici-no-destroy.test.js

@@ -27,3 +27,25 @@ test('destroyAgent false', async (t) => {
   await instance.ready()
   await instance.close()
 })
+
+test('destroyAgent default false', async (t) => {
+  const mockAgent = new undici.Agent()
+  mockAgent.destroy = () => {
+    t.fail()
+  }
+  const instance = Fastify()
+
+  t.after(() => instance.close())
+
+  instance.get('/', (_request, reply) => {
+    reply.from()
+  })
+
+  instance.register(From, {
+    base: 'http://localhost:4242',
+    undici: mockAgent
+  })
+
+  await instance.ready()
+  await instance.close()
+})

package/.github/stale.yml

@@ -1,21 +0,0 @@
-# Number of days of inactivity before an issue becomes stale
-daysUntilStale: 15
-# Number of days of inactivity before a stale issue is closed
-daysUntilClose: 7
-# Issues with these labels will never be considered stale
-exemptLabels:
-  - "discussion"
-  - "feature request"
-  - "bug"
-  - "help wanted"
-  - "plugin suggestion"
-  - "good first issue"
-# Label to use when marking an issue as stale
-staleLabel: stale
-# Comment to post when marking an issue as stale. Set to `false` to disable
-markComment: >
-  This issue has been automatically marked as stale because it has not had
-  recent activity. It will be closed if no further activity occurs. Thank you
-  for your contributions.
-# Comment to post when closing a stale issue. Set to `false` to disable
-closeComment: false

package/.taprc

@@ -1,3 +0,0 @@
-disable-coverage: true
-files:
-  - test/**/*.test.js

package/CLAUDE.md

@@ -1,66 +0,0 @@
-# CLAUDE.md
-
-This file provides guidance to Claude Code (claude.ai/code) when working with code in this repository.
-
-## Development Commands
-
-### Testing
-- `npm test` - Run all tests (unit + TypeScript)
-- `npm run test:unit` - Run unit tests with coverage using c8 and Node.js test runner
-- `npm run test:typescript` - Run TypeScript definition tests using tsd
-
-### Linting
-- `npm run lint` - Run ESLint to check code style
-- `npm run lint:fix` - Run ESLint with automatic fixes
-- ESLint configuration uses neostandard with TypeScript support
-
-### Building
-- No build step required - this is a CommonJS library
-
-## Architecture Overview
-
-This is a Fastify plugin for proxying HTTP requests to upstream servers. The plugin decorates the Fastify reply with a `from()` method.
-
-### Key Components
-
-**Main Plugin (`index.js`)**
-- Entry point that registers the plugin using fastify-plugin
-- Decorates `reply.from(source, opts)` method
-- Handles request proxying, retries, caching, and error handling
-- Supports HTTP/1.1, HTTP/2, and Undici client strategies
-
-**Request Builder (`lib/request.js`)**
-- Factory for creating request handlers based on transport (HTTP/1.1, HTTP/2, Undici)
-- Handles different agent configurations (HTTP, HTTPS, Unix sockets)
-- Manages timeouts, connection pooling, and retry logic
-- Returns unified interface: `{ request, close, retryOnError }`
-
-**Utilities (`lib/utils.js`)**
-- `filterPseudoHeaders()` - Removes HTTP/2 pseudo-headers (starting with :)
-- `copyHeaders()` - Copies headers to Fastify reply
-- `stripHttp1ConnectionHeaders()` - Removes HTTP/1 connection-specific headers for HTTP/2
-- `buildURL()` - Constructs destination URLs with base path validation
-
-**Error Definitions (`lib/errors.js`)**
-- Standardized error types using @fastify/error
-- Maps different error conditions to appropriate HTTP status codes
-- Includes timeout, connection reset, and gateway errors
-
-### Transport Strategies
-
-1. **Undici (default)** - High-performance HTTP/1.1 client with connection pooling
-2. **HTTP/2** - Native Node.js HTTP/2 client for modern protocols  
-3. **HTTP/1.1** - Node.js built-in http/https modules with custom agents
-
-### Key Features
-
-- **Caching**: URL parsing cache using toad-cache LruMap (default 100 entries)
-- **Retries**: Configurable retry logic for socket hangups and 503 errors
-- **Headers**: Smart header rewriting for HTTP/1.1 ↔ HTTP/2 compatibility
-- **Body handling**: Supports streams, JSON encoding, and custom content types
-- **Unix sockets**: Special handling for unix+http: and unix+https: protocols
-- **Timeouts**: Per-request and session-level timeout configuration
-
-### Configuration
-
-The plugin accepts extensive configuration for different transport methods, retry behavior, caching, and request/response transformation hooks. See README.md for full option documentation.