@jongleberry/api-server 1.0.3 → 1.0.4

package/dist/application.mjs

@@ -4,7 +4,7 @@ import { createRouteBuilder } from "./router.mjs";
 import Router from "find-my-way";
 import { ServerTiming } from "./server-timing.mjs";
 import { Logger } from "./logger.mjs";
-import { getFallbackBody, getFallbackStatus, sendFallback } from "./fallback-response.mjs";
+import { ensureFallbackHeaders, getFallbackBody, getFallbackStatus, sendFallback, } from "./fallback-response.mjs";
 export class Application extends EventEmitter {
     router = Router();
     errorHandlerFn = null;
@@ -57,6 +57,7 @@ export class Application extends EventEmitter {
                 // Swallow listener throws so the 500 response still goes out.
             }
             if (!res.headersSent) {
+                ensureFallbackHeaders(res);
                 res.writeHead(500);
                 res.end("Internal Server Error");
             }
@@ -100,6 +101,7 @@ export class Application extends EventEmitter {
                     await this.notFoundHandlerFn(ctx);
                 }
                 else {
+                    ensureFallbackHeaders(res);
                     res.writeHead(404);
                     res.end("Not Found");
                 }
@@ -129,6 +131,7 @@ export class Application extends EventEmitter {
             }
             else if (!res.headersSent) {
                 const status = getFallbackStatus(error);
+                ensureFallbackHeaders(res);
                 res.writeHead(status);
                 res.end(getFallbackBody(error, status));
             }

package/dist/fallback-response.d.mts

@@ -1,4 +1,5 @@
 import type { ServerResponse } from "node:http";
+export declare function ensureFallbackHeaders(res: ServerResponse): void;
 export declare function sendFallback(res: ServerResponse): void;
 export declare function getFallbackStatus(error: unknown): number;
 export declare function getFallbackBody(error: unknown, status: number): string;

package/dist/fallback-response.mjs

@@ -1,8 +1,28 @@
 const FALLBACK_BODY = "Not Found";
 const ERROR_STATUS = 500;
 const ERROR_BODY = "Internal Server Error";
+const TEXT_PLAIN_CONTENT_TYPE = "text/plain; charset=utf-8";
+const FALLBACK_HEADERS = {
+    "Content-Type": TEXT_PLAIN_CONTENT_TYPE,
+    "X-XSS-Protection": "0",
+    "X-Frame-Options": "SAMEORIGIN",
+    "X-Content-Type-Options": "nosniff",
+};
+export function ensureFallbackHeaders(res) {
+    for (const [name, value] of Object.entries(FALLBACK_HEADERS)) {
+        try {
+            if (typeof res.hasHeader !== "function" || !res.hasHeader(name)) {
+                res.setHeader(name, value);
+            }
+        }
+        catch {
+            // Header mutation can fail on destroyed sockets or non-standard responses.
+        }
+    }
+}
 export function sendFallback(res) {
     try {
+        ensureFallbackHeaders(res);
         res.writeHead(ERROR_STATUS);
         res.end(ERROR_BODY);
     }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@jongleberry/api-server",
-  "version": "1.0.3",
+  "version": "1.0.4",
   "description": "A Node.js HTTP server library",
   "license": "MIT",
   "author": "Jonathan Ong",