@jsenv/server 17.6.5 → 17.6.7

package/dist/jsenv_server.js

@@ -1150,6 +1150,62 @@ const stringifyHeaderProperty = ({ name, value }) => {
   return `${name}=${value}`;
 };
 
+/*
+ * A request target is the text between the method and the http version on the
+ * request line (RFC 9112 section 3.2), or the ":path" pseudo header in http2.
+ * It is a path, not a url reference, and the two must never be confused:
+ * "//wp-includes/x" is an origin-form target whose first path segment is
+ * empty, but `new URL("//wp-includes/x", origin)` reads it as a
+ * protocol-relative reference and turns "wp-includes" into the host. So the
+ * path is assigned onto the origin instead, and what a client sends can never
+ * replace that origin.
+ *
+ * The one form that legitimately names an origin is absolute-form
+ * ("GET http://host/path", sent by proxies and open-proxy scanners); it is
+ * read as such so the origin it names goes through the allowedHosts check
+ * like any other host, instead of reaching the routes unchecked.
+ */
+
+const ABSOLUTE_FORM_REGEX = /^[a-z][a-z0-9+\-.]*:\/\//i;
+
+/**
+ * @param {string} target the raw request target
+ * @returns {{ origin: string|null, host: string|null, resource: string }|null}
+ *   null when the target cannot be read; the server answers 400
+ */
+const readRequestTarget = (target) => {
+  if (!ABSOLUTE_FORM_REGEX.test(target)) {
+    // origin-form ("/path?query"), asterisk-form ("*") or authority-form
+    return { origin: null, host: null, resource: target };
+  }
+  if (!URL.canParse(target)) {
+    return null;
+  }
+  const urlObject = new URL(target);
+  if (urlObject.protocol !== "http:" && urlObject.protocol !== "https:") {
+    return null;
+  }
+  return {
+    origin: urlObject.origin,
+    host: urlObject.host,
+    resource: `${urlObject.pathname}${urlObject.search}`,
+  };
+};
+
+// the search of baseUrl is dropped: the resource carries its own
+const resourceToUrlObject = (resource, baseUrl) => {
+  const urlObject = new URL(baseUrl);
+  const searchSeparatorIndex = resource.indexOf("?");
+  if (searchSeparatorIndex === -1) {
+    urlObject.pathname = resource;
+    urlObject.search = "";
+  } else {
+    urlObject.pathname = resource.slice(0, searchSeparatorIndex);
+    urlObject.search = resource.slice(searchSeparatorIndex);
+  }
+  return urlObject;
+};
+
 // https://wicg.github.io/observable/#core-infrastructure
 
 if ("observable" in Symbol === false) {
@@ -1329,8 +1385,13 @@ const fromNodeRequest = (
   nodeRequest.pause();
   const body = observableFromNodeStream(nodeRequest);
 
+  // an absolute-form target names the origin the request is for; the host
+  // header is ignored in that case (RFC 9112 section 3.3)
+  const requestTarget = readRequestTarget(nodeRequest.url);
   let requestOrigin;
-  if (nodeRequest.upgrade) {
+  if (requestTarget.origin) {
+    requestOrigin = requestTarget.origin;
+  } else if (nodeRequest.upgrade) {
     requestOrigin = serverOrigin;
   } else if (nodeRequest.authority) {
     requestOrigin = nodeRequest.connection.encrypted
@@ -1463,7 +1524,7 @@ const fromNodeRequest = (
     http2: Boolean(nodeRequest.stream),
     origin: requestOrigin,
     ...getPropertiesFromResource({
-      resource: nodeRequest.url,
+      resource: requestTarget.resource,
       baseUrl: requestOrigin,
     }),
     method: nodeRequest.method,
@@ -1690,13 +1751,12 @@ const applyRedirectionToRequest = (
   };
 };
 const getPropertiesFromResource = ({ resource, baseUrl }) => {
-  const urlObject = new URL(resource, baseUrl);
-  let pathname = urlObject.pathname;
+  const urlObject = resourceToUrlObject(resource, baseUrl);
 
   return {
     url: String(urlObject),
     searchParams: urlObject.searchParams,
-    pathname,
+    pathname: urlObject.pathname,
     resource,
   };
 };
@@ -5833,8 +5893,17 @@ const createResourcePattern = (pattern) => {
   }
 
   const patternEndsWithSlash = pathnamePatternString.endsWith("/");
+  // a pattern constraining nothing: every resource matches it, so whoever uses
+  // it cannot name the resource that matched
+  const matchesEveryResource =
+    !searchPattern &&
+    !hashPattern &&
+    (pathnamePatternString === "*" ||
+      pathnamePatternString === "/" ||
+      pathnamePatternString === "/*");
 
   return {
+    matchesEveryResource,
     match: (resource) => {
       const [pathname, search, hash] = resourceToParts(resource);
       let decodedPathname = decodeURIComponent(pathname);
@@ -6477,9 +6546,9 @@ It should be should be one of route.${routePropertyName}: ${availableValues.join
         }
         if (!route.matchMethod(request.method)) {
           // a 405 asserts the resource exists with other methods: a route
-          // matching any resource ("GET *") cannot assert that, so it does
-          // not turn an unknown resource into a 405
-          if (!route.isFallback && route.resource !== "*") {
+          // matching every resource ("GET *", "GET /") names no resource, so
+          // it cannot make that assertion and an unknown address stays a 404
+          if (!route.isFallback && !route.matchesEveryResource) {
             wouldHaveMatched.methodSet.add(route.method);
           }
           continue;
@@ -6827,6 +6896,8 @@ const createRoute = ({
         : (requestResource) => {
             return resourcePattern.match(requestResource);
           },
+    matchesEveryResource:
+      resource === "*" || resourcePattern.matchesEveryResource,
     matchHeaders:
       headers === undefined
         ? () => true
@@ -7309,11 +7380,14 @@ const TIMING_NOOP = () => {
  *   - `GET /@jsenv/server/*`, serving this package's own client files;
  *   - `/.internal/alive.websocket` and `/.internal/alive.eventsource`, which a client
  *     subscribes to in order to reload when the server restarts.
- * @param {boolean|Object} [params.serverTiming=false] - `true` or `{ minDuration }` to send
- *   `server-timing` response headers: the time to start responding, the routing of each
- *   plugin, what routes measure with `helpers.timing` and the `timing` a response hands
- *   back. `minDuration` (ms) drops the entries that took less: 0 keeps everything (what a
- *   test wants), a human reading devtools usually wants the sub-millisecond noise gone.
+ * @param {boolean|Function|Object} [params.serverTiming=false] - `true`, `(request) =>
+ *   boolean` or `{ enabled, minDuration }` to send `server-timing` response headers: the
+ *   time to start responding, the routing of each plugin, what routes measure with
+ *   `helpers.timing` and the `timing` a response hands back. `enabled` can be a function
+ *   too: it is asked once per request, so a server can measure for a client it recognizes
+ *   (a header, a cookie, an origin) and stay silent for everyone else. `minDuration` (ms)
+ *   drops the entries that took less: 0 keeps everything (what a test wants), a human
+ *   reading devtools usually wants the sub-millisecond noise gone.
  * @param {number} [params.requestWaitingMs=0] - Call `requestWaitingCallback` when a request
  *   still has no response after that many ms (0 disables).
  * @param {Function} [params.requestWaitingCallback] - `({ request, requestWaitingMs })`, logs a warning by default.
@@ -7670,13 +7744,16 @@ const startServer = async ({
     sendResponseOperation.addAbortSignal(receiveRequestOperation.signal);
     return [receiveRequestOperation, sendResponseOperation];
   };
-  const serverTimingMinDuration =
-    serverTiming && typeof serverTiming === "object"
-      ? serverTiming.minDuration || 0
-      : 0;
+  const { serverTimingEnabled, serverTimingMinDuration } =
+    resolveServerTiming(serverTiming);
   const getResponseProperties = async (request) => {
+    // Asked once per request, on what the client sent: an api can then measure
+    // for everyone and disclose to a token, a cookie, an origin — instead of
+    // choosing between measuring nothing and telling every client what it does
+    // internally.
+    const timingEnabled = serverTimingEnabled(request);
     const timings = {};
-    const timing = serverTiming
+    const timing = timingEnabled
       ? (name) => {
           const start = performance.now();
           timings[name] = null;
@@ -7711,7 +7788,7 @@ const startServer = async ({
 
     let headersToInject;
     const finalizeResponseProperties = (responseProperties) => {
-      if (serverTiming) {
+      if (timingEnabled) {
         startRespondingTiming.end();
         // A response can hand back measures of its own (a `timing` property —
         // durations keyed by description, null for a plain marker): they join
@@ -7966,7 +8043,14 @@ const startServer = async ({
 
   {
     const requestEventHandler = async (nodeRequest, nodeResponse) => {
-      const requestHost = nodeRequest.authority || nodeRequest.headers.host;
+      const requestTarget = readRequestTarget(nodeRequest.url);
+      if (!requestTarget) {
+        nodeResponse.writeHead(400, "Request url is not supported");
+        nodeResponse.end();
+        return;
+      }
+      const requestHost =
+        requestTarget.host || nodeRequest.authority || nodeRequest.headers.host;
       if (!isHostAllowed(requestHost)) {
         logger.warn(
           `${nodeRequest.method} ${nodeRequest.url} refused: host "${requestHost}" is not allowed (see the allowedHosts option)`,
@@ -7977,19 +8061,11 @@ const startServer = async ({
       }
       if (redirectHttpToHttps && !nodeRequest.connection.encrypted) {
         nodeResponse.writeHead(301, {
-          location: `${serverOrigin}${nodeRequest.url}`,
+          location: `${serverOrigin}${requestTarget.resource}`,
         });
         nodeResponse.end();
         return;
       }
-      try {
-        // eslint-disable-next-line no-new
-        new URL(nodeRequest.url, "http://example.com");
-      } catch {
-        nodeResponse.writeHead(400, "Request url is not supported");
-        nodeResponse.end();
-        return;
-      }
 
       const [receiveRequestOperation, sendResponseOperation] =
         prepareHandleRequestOperations(nodeRequest, nodeResponse);
@@ -8066,7 +8142,13 @@ const startServer = async ({
     };
     // https://github.com/websockets/ws/blob/b92745a9d6760e6b4b2394bfac78cbcd258a8c8d/lib/websocket-server.js#L491
     const upgradeEventHandler = async (nodeRequest, socket, head) => {
-      const requestHost = nodeRequest.headers.host;
+      const requestTarget = readRequestTarget(nodeRequest.url);
+      if (!requestTarget) {
+        socket.write(`HTTP/1.1 400 Request url is not supported\r\n\r\n`);
+        socket.destroy();
+        return;
+      }
+      const requestHost = requestTarget.host || nodeRequest.headers.host;
       if (!isHostAllowed(requestHost)) {
         logger.warn(
           `${nodeRequest.method} ${nodeRequest.url} refused: host "${requestHost}" is not allowed (see the allowedHosts option)`,
@@ -8233,6 +8315,36 @@ const PROCESS_TEARDOWN_EVENTS_MAP = {
   exit: STOP_REASON_PROCESS_EXIT,
 };
 
+const SERVER_TIMING_DISABLED = () => false;
+const SERVER_TIMING_ENABLED = () => true;
+
+const resolveServerTiming = (serverTiming) => {
+  if (typeof serverTiming === "function") {
+    return {
+      serverTimingEnabled: serverTiming,
+      serverTimingMinDuration: 0,
+    };
+  }
+  if (serverTiming && typeof serverTiming === "object") {
+    const { enabled = true, minDuration = 0 } = serverTiming;
+    return {
+      serverTimingEnabled:
+        typeof enabled === "function"
+          ? enabled
+          : enabled
+            ? SERVER_TIMING_ENABLED
+            : SERVER_TIMING_DISABLED,
+      serverTimingMinDuration: minDuration,
+    };
+  }
+  return {
+    serverTimingEnabled: serverTiming
+      ? SERVER_TIMING_ENABLED
+      : SERVER_TIMING_DISABLED,
+    serverTimingMinDuration: 0,
+  };
+};
+
 const internalErrorHtmlFileUrl = import.meta.resolve("./client/error_handler/500.html");
 let internalErrorHtmlTemplate;
 const readInternalErrorHtmlTemplate = () => {
@@ -8421,6 +8533,9 @@ class ProgressiveResponse {
  * so here we just need to add the CORS headers to the response
  */
 
+const TIMING_ALLOW_ORIGIN_DISABLED = () => false;
+const TIMING_ALLOW_ORIGIN_ENABLED = () => true;
+
 const jsenvAccessControlAllowedHeaders = ["x-requested-with"];
 
 const jsenvAccessControlAllowedMethods = [
@@ -8453,8 +8568,10 @@ const jsenvAccessControlAllowedMethods = [
  * @param {boolean} [params.accessControlAllowCredentials=false] - Send
  *   `access-control-allow-credentials: true`.
  * @param {number} [params.accessControlMaxAge=600] - Seconds a browser may cache the preflight.
- * @param {boolean} [params.timingAllowOrigin=false] - Send `timing-allow-origin` so the
- *   allowed origin can read resource timing.
+ * @param {boolean|Function} [params.timingAllowOrigin=false] - Send `timing-allow-origin`
+ *   so the allowed origin can read resource timing (the `server-timing` header included).
+ *   A `(request) => boolean` is asked once per request, so it can be the very test that
+ *   decides `startServer({ serverTiming })`.
  * @returns {Object|Array} The plugin, or `[]` when CORS stays disabled.
  */
 const serverPluginCORS = ({
@@ -8482,6 +8599,12 @@ const serverPluginCORS = ({
   const allowedOriginChecker = createAllowedOriginChecker(
     accessControlAllowedOrigins,
   );
+  const timingAllowOriginEnabled =
+    typeof timingAllowOrigin === "function"
+      ? timingAllowOrigin
+      : timingAllowOrigin
+        ? TIMING_ALLOW_ORIGIN_ENABLED
+        : TIMING_ALLOW_ORIGIN_DISABLED;
 
   return {
     name: "jsenv:cors",
@@ -8496,7 +8619,7 @@ const serverPluginCORS = ({
         accessControlAllowRequestHeaders,
         accessControlAllowCredentials,
         accessControlMaxAge,
-        timingAllowOrigin,
+        timingAllowOriginEnabled,
       });
       return {
         headers: accessControlHeaders,
@@ -8550,7 +8673,7 @@ const originPatternToRegExp = (originPattern) => {
 // https://www.w3.org/TR/cors/
 // https://developer.mozilla.org/en-US/docs/Web/HTTP/CORS
 const generateAccessControlHeaders = ({
-  request: { headers },
+  request,
   allowedOriginChecker,
   accessControlAllowRequestOrigin,
   accessControlAllowedMethods,
@@ -8561,8 +8684,9 @@ const generateAccessControlHeaders = ({
   // by default OPTIONS request can be cache for a long time, it's not going to change soon ?
   // we could put a lot here, see https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Access-Control-Max-Age
   accessControlMaxAge = 600,
-  timingAllowOrigin,
+  timingAllowOriginEnabled,
 } = {}) => {
+  const { headers } = request;
   const vary = [];
 
   // Access-Control-Allow-Origin must be a single value (not a list).
@@ -8626,7 +8750,9 @@ const generateAccessControlHeaders = ({
       ? { "access-control-allow-credentials": true }
       : {}),
     "access-control-max-age": accessControlMaxAge,
-    ...(timingAllowOrigin ? { "timing-allow-origin": allowOrigin } : {}),
+    ...(timingAllowOriginEnabled(request)
+      ? { "timing-allow-origin": allowOrigin }
+      : {}),
     ...(vary.length ? { vary: vary.join(", ") } : {}),
   };
 };
@@ -8937,8 +9063,11 @@ const fetchFileSystem = async (
   if (request.params && "0" in request.params) {
     resource = request.params["0"];
   } else {
-    resource = request.resource.slice(1);
+    resource = request.resource;
   }
+  // the resource is resolved against the served directory, so it must stay a
+  // relative reference: a leading slash would resolve to the filesystem root
+  resource = resource.replace(/^\/+/, "");
   const filesystemUrl = new URL(resource, directoryUrlString);
   const urlString = asUrlString(filesystemUrl);
   if (!urlIsOrIsInsideOf(urlString, directoryUrlString)) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@jsenv/server",
-  "version": "17.6.5",
+  "version": "17.6.7",
   "type": "module",
   "description": "A modern Node.js HTTP server with declarative routing, content negotiation, and WebSocket support",
   "repository": {

package/src/interfacing_with_node/from_node_request.js

@@ -20,6 +20,10 @@ import {
 } from "../internal/colorize_response_status.js";
 import { headersFromObject } from "../internal/headers_from_object.js";
 import { parseSingleHeaderWithAttributes } from "../internal/multiple_header.js";
+import {
+  readRequestTarget,
+  resourceToUrlObject,
+} from "../internal/request_target.js";
 import { observableFromNodeStream } from "./observable_from_node_stream.js";
 
 export const fromNodeRequest = (
@@ -66,8 +70,13 @@ export const fromNodeRequest = (
   nodeRequest.pause();
   const body = observableFromNodeStream(nodeRequest);
 
+  // an absolute-form target names the origin the request is for; the host
+  // header is ignored in that case (RFC 9112 section 3.3)
+  const requestTarget = readRequestTarget(nodeRequest.url);
   let requestOrigin;
-  if (nodeRequest.upgrade) {
+  if (requestTarget.origin) {
+    requestOrigin = requestTarget.origin;
+  } else if (nodeRequest.upgrade) {
     requestOrigin = serverOrigin;
   } else if (nodeRequest.authority) {
     requestOrigin = nodeRequest.connection.encrypted
@@ -200,7 +209,7 @@ export const fromNodeRequest = (
     http2: Boolean(nodeRequest.stream),
     origin: requestOrigin,
     ...getPropertiesFromResource({
-      resource: nodeRequest.url,
+      resource: requestTarget.resource,
       baseUrl: requestOrigin,
     }),
     method: nodeRequest.method,
@@ -440,13 +449,12 @@ export const applyRedirectionToRequest = (
   };
 };
 const getPropertiesFromResource = ({ resource, baseUrl }) => {
-  const urlObject = new URL(resource, baseUrl);
-  let pathname = urlObject.pathname;
+  const urlObject = resourceToUrlObject(resource, baseUrl);
 
   return {
     url: String(urlObject),
     searchParams: urlObject.searchParams,
-    pathname,
+    pathname: urlObject.pathname,
     resource,
   };
 };

package/src/internal/request_target.js

@@ -0,0 +1,55 @@
+/*
+ * A request target is the text between the method and the http version on the
+ * request line (RFC 9112 section 3.2), or the ":path" pseudo header in http2.
+ * It is a path, not a url reference, and the two must never be confused:
+ * "//wp-includes/x" is an origin-form target whose first path segment is
+ * empty, but `new URL("//wp-includes/x", origin)` reads it as a
+ * protocol-relative reference and turns "wp-includes" into the host. So the
+ * path is assigned onto the origin instead, and what a client sends can never
+ * replace that origin.
+ *
+ * The one form that legitimately names an origin is absolute-form
+ * ("GET http://host/path", sent by proxies and open-proxy scanners); it is
+ * read as such so the origin it names goes through the allowedHosts check
+ * like any other host, instead of reaching the routes unchecked.
+ */
+
+const ABSOLUTE_FORM_REGEX = /^[a-z][a-z0-9+\-.]*:\/\//i;
+
+/**
+ * @param {string} target the raw request target
+ * @returns {{ origin: string|null, host: string|null, resource: string }|null}
+ *   null when the target cannot be read; the server answers 400
+ */
+export const readRequestTarget = (target) => {
+  if (!ABSOLUTE_FORM_REGEX.test(target)) {
+    // origin-form ("/path?query"), asterisk-form ("*") or authority-form
+    return { origin: null, host: null, resource: target };
+  }
+  if (!URL.canParse(target)) {
+    return null;
+  }
+  const urlObject = new URL(target);
+  if (urlObject.protocol !== "http:" && urlObject.protocol !== "https:") {
+    return null;
+  }
+  return {
+    origin: urlObject.origin,
+    host: urlObject.host,
+    resource: `${urlObject.pathname}${urlObject.search}`,
+  };
+};
+
+// the search of baseUrl is dropped: the resource carries its own
+export const resourceToUrlObject = (resource, baseUrl) => {
+  const urlObject = new URL(baseUrl);
+  const searchSeparatorIndex = resource.indexOf("?");
+  if (searchSeparatorIndex === -1) {
+    urlObject.pathname = resource;
+    urlObject.search = "";
+  } else {
+    urlObject.pathname = resource.slice(0, searchSeparatorIndex);
+    urlObject.search = resource.slice(searchSeparatorIndex);
+  }
+  return urlObject;
+};

package/src/plugins/cors/server_plugin_cors.js

@@ -3,6 +3,9 @@
  * so here we just need to add the CORS headers to the response
  */
 
+const TIMING_ALLOW_ORIGIN_DISABLED = () => false;
+const TIMING_ALLOW_ORIGIN_ENABLED = () => true;
+
 export const jsenvAccessControlAllowedHeaders = ["x-requested-with"];
 
 export const jsenvAccessControlAllowedMethods = [
@@ -35,8 +38,10 @@ export const jsenvAccessControlAllowedMethods = [
  * @param {boolean} [params.accessControlAllowCredentials=false] - Send
  *   `access-control-allow-credentials: true`.
  * @param {number} [params.accessControlMaxAge=600] - Seconds a browser may cache the preflight.
- * @param {boolean} [params.timingAllowOrigin=false] - Send `timing-allow-origin` so the
- *   allowed origin can read resource timing.
+ * @param {boolean|Function} [params.timingAllowOrigin=false] - Send `timing-allow-origin`
+ *   so the allowed origin can read resource timing (the `server-timing` header included).
+ *   A `(request) => boolean` is asked once per request, so it can be the very test that
+ *   decides `startServer({ serverTiming })`.
  * @returns {Object|Array} The plugin, or `[]` when CORS stays disabled.
  */
 export const serverPluginCORS = ({
@@ -64,6 +69,12 @@ export const serverPluginCORS = ({
   const allowedOriginChecker = createAllowedOriginChecker(
     accessControlAllowedOrigins,
   );
+  const timingAllowOriginEnabled =
+    typeof timingAllowOrigin === "function"
+      ? timingAllowOrigin
+      : timingAllowOrigin
+        ? TIMING_ALLOW_ORIGIN_ENABLED
+        : TIMING_ALLOW_ORIGIN_DISABLED;
 
   return {
     name: "jsenv:cors",
@@ -78,7 +89,7 @@ export const serverPluginCORS = ({
         accessControlAllowRequestHeaders,
         accessControlAllowCredentials,
         accessControlMaxAge,
-        timingAllowOrigin,
+        timingAllowOriginEnabled,
       });
       return {
         headers: accessControlHeaders,
@@ -132,7 +143,7 @@ const originPatternToRegExp = (originPattern) => {
 // https://www.w3.org/TR/cors/
 // https://developer.mozilla.org/en-US/docs/Web/HTTP/CORS
 const generateAccessControlHeaders = ({
-  request: { headers },
+  request,
   allowedOriginChecker,
   accessControlAllowRequestOrigin,
   accessControlAllowedMethods,
@@ -143,8 +154,9 @@ const generateAccessControlHeaders = ({
   // by default OPTIONS request can be cache for a long time, it's not going to change soon ?
   // we could put a lot here, see https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Access-Control-Max-Age
   accessControlMaxAge = 600,
-  timingAllowOrigin,
+  timingAllowOriginEnabled,
 } = {}) => {
+  const { headers } = request;
   const vary = [];
 
   // Access-Control-Allow-Origin must be a single value (not a list).
@@ -208,7 +220,9 @@ const generateAccessControlHeaders = ({
       ? { "access-control-allow-credentials": true }
       : {}),
     "access-control-max-age": accessControlMaxAge,
-    ...(timingAllowOrigin ? { "timing-allow-origin": allowOrigin } : {}),
+    ...(timingAllowOriginEnabled(request)
+      ? { "timing-allow-origin": allowOrigin }
+      : {}),
     ...(vary.length ? { vary: vary.join(", ") } : {}),
   };
 };

package/src/plugins/filesystem/fetch_file.js

@@ -112,8 +112,11 @@ export const fetchFileSystem = async (
   if (request.params && "0" in request.params) {
     resource = request.params["0"];
   } else {
-    resource = request.resource.slice(1);
+    resource = request.resource;
   }
+  // the resource is resolved against the served directory, so it must stay a
+  // relative reference: a leading slash would resolve to the filesystem root
+  resource = resource.replace(/^\/+/, "");
   const filesystemUrl = new URL(resource, directoryUrlString);
   const urlString = asUrlString(filesystemUrl);
   if (!urlIsOrIsInsideOf(urlString, directoryUrlString)) {

package/src/router/router.js

@@ -356,9 +356,9 @@ It should be should be one of route.${routePropertyName}: ${availableValues.join
         }
         if (!route.matchMethod(request.method)) {
           // a 405 asserts the resource exists with other methods: a route
-          // matching any resource ("GET *") cannot assert that, so it does
-          // not turn an unknown resource into a 405
-          if (!route.isFallback && route.resource !== "*") {
+          // matching every resource ("GET *", "GET /") names no resource, so
+          // it cannot make that assertion and an unknown address stays a 404
+          if (!route.isFallback && !route.matchesEveryResource) {
             wouldHaveMatched.methodSet.add(route.method);
           }
           continue;
@@ -709,6 +709,8 @@ const createRoute = ({
         : (requestResource) => {
             return resourcePattern.match(requestResource);
           },
+    matchesEveryResource:
+      resource === "*" || resourcePattern.matchesEveryResource,
     matchHeaders:
       headers === undefined
         ? () => true

package/src/start_server.js

@@ -18,6 +18,7 @@ import { listen, stopListening } from "./internal/listen.js";
 import { listenEvent } from "./internal/listen_event.js";
 import { listenRequest } from "./internal/listen_request.js";
 import { listenServerConnectionError } from "./internal/listen_server_connection_error.js";
+import { readRequestTarget } from "./internal/request_target.js";
 import { composeTwoResponses } from "./internal/response_composition.js";
 import { createSecureServer } from "./internal/secure_server.js";
 import { resolveServerOrigins } from "./internal/server_origins.js";
@@ -129,11 +130,14 @@ const TIMING_NOOP = () => {
  *   - `GET /@jsenv/server/*`, serving this package's own client files;
  *   - `/.internal/alive.websocket` and `/.internal/alive.eventsource`, which a client
  *     subscribes to in order to reload when the server restarts.
- * @param {boolean|Object} [params.serverTiming=false] - `true` or `{ minDuration }` to send
- *   `server-timing` response headers: the time to start responding, the routing of each
- *   plugin, what routes measure with `helpers.timing` and the `timing` a response hands
- *   back. `minDuration` (ms) drops the entries that took less: 0 keeps everything (what a
- *   test wants), a human reading devtools usually wants the sub-millisecond noise gone.
+ * @param {boolean|Function|Object} [params.serverTiming=false] - `true`, `(request) =>
+ *   boolean` or `{ enabled, minDuration }` to send `server-timing` response headers: the
+ *   time to start responding, the routing of each plugin, what routes measure with
+ *   `helpers.timing` and the `timing` a response hands back. `enabled` can be a function
+ *   too: it is asked once per request, so a server can measure for a client it recognizes
+ *   (a header, a cookie, an origin) and stay silent for everyone else. `minDuration` (ms)
+ *   drops the entries that took less: 0 keeps everything (what a test wants), a human
+ *   reading devtools usually wants the sub-millisecond noise gone.
  * @param {number} [params.requestWaitingMs=0] - Call `requestWaitingCallback` when a request
  *   still has no response after that many ms (0 disables).
  * @param {Function} [params.requestWaitingCallback] - `({ request, requestWaitingMs })`, logs a warning by default.
@@ -490,13 +494,16 @@ export const startServer = async ({
     sendResponseOperation.addAbortSignal(receiveRequestOperation.signal);
     return [receiveRequestOperation, sendResponseOperation];
   };
-  const serverTimingMinDuration =
-    serverTiming && typeof serverTiming === "object"
-      ? serverTiming.minDuration || 0
-      : 0;
+  const { serverTimingEnabled, serverTimingMinDuration } =
+    resolveServerTiming(serverTiming);
   const getResponseProperties = async (request) => {
+    // Asked once per request, on what the client sent: an api can then measure
+    // for everyone and disclose to a token, a cookie, an origin — instead of
+    // choosing between measuring nothing and telling every client what it does
+    // internally.
+    const timingEnabled = serverTimingEnabled(request);
     const timings = {};
-    const timing = serverTiming
+    const timing = timingEnabled
       ? (name) => {
           const start = performance.now();
           timings[name] = null;
@@ -531,7 +538,7 @@ export const startServer = async ({
 
     let headersToInject;
     const finalizeResponseProperties = (responseProperties) => {
-      if (serverTiming) {
+      if (timingEnabled) {
         startRespondingTiming.end();
         // A response can hand back measures of its own (a `timing` property —
         // durations keyed by description, null for a plain marker): they join
@@ -786,7 +793,14 @@ export const startServer = async ({
 
   request: {
     const requestEventHandler = async (nodeRequest, nodeResponse) => {
-      const requestHost = nodeRequest.authority || nodeRequest.headers.host;
+      const requestTarget = readRequestTarget(nodeRequest.url);
+      if (!requestTarget) {
+        nodeResponse.writeHead(400, "Request url is not supported");
+        nodeResponse.end();
+        return;
+      }
+      const requestHost =
+        requestTarget.host || nodeRequest.authority || nodeRequest.headers.host;
       if (!isHostAllowed(requestHost)) {
         logger.warn(
           `${nodeRequest.method} ${nodeRequest.url} refused: host "${requestHost}" is not allowed (see the allowedHosts option)`,
@@ -797,19 +811,11 @@ export const startServer = async ({
       }
       if (redirectHttpToHttps && !nodeRequest.connection.encrypted) {
         nodeResponse.writeHead(301, {
-          location: `${serverOrigin}${nodeRequest.url}`,
+          location: `${serverOrigin}${requestTarget.resource}`,
         });
         nodeResponse.end();
         return;
       }
-      try {
-        // eslint-disable-next-line no-new
-        new URL(nodeRequest.url, "http://example.com");
-      } catch {
-        nodeResponse.writeHead(400, "Request url is not supported");
-        nodeResponse.end();
-        return;
-      }
 
       const [receiveRequestOperation, sendResponseOperation] =
         prepareHandleRequestOperations(nodeRequest, nodeResponse);
@@ -891,7 +897,13 @@ export const startServer = async ({
     };
     // https://github.com/websockets/ws/blob/b92745a9d6760e6b4b2394bfac78cbcd258a8c8d/lib/websocket-server.js#L491
     const upgradeEventHandler = async (nodeRequest, socket, head) => {
-      const requestHost = nodeRequest.headers.host;
+      const requestTarget = readRequestTarget(nodeRequest.url);
+      if (!requestTarget) {
+        socket.write(`HTTP/1.1 400 Request url is not supported\r\n\r\n`);
+        socket.destroy();
+        return;
+      }
+      const requestHost = requestTarget.host || nodeRequest.headers.host;
       if (!isHostAllowed(requestHost)) {
         logger.warn(
           `${nodeRequest.method} ${nodeRequest.url} refused: host "${requestHost}" is not allowed (see the allowedHosts option)`,
@@ -1057,3 +1069,33 @@ const PROCESS_TEARDOWN_EVENTS_MAP = {
   beforeExit: STOP_REASON_PROCESS_BEFORE_EXIT,
   exit: STOP_REASON_PROCESS_EXIT,
 };
+
+const SERVER_TIMING_DISABLED = () => false;
+const SERVER_TIMING_ENABLED = () => true;
+
+const resolveServerTiming = (serverTiming) => {
+  if (typeof serverTiming === "function") {
+    return {
+      serverTimingEnabled: serverTiming,
+      serverTimingMinDuration: 0,
+    };
+  }
+  if (serverTiming && typeof serverTiming === "object") {
+    const { enabled = true, minDuration = 0 } = serverTiming;
+    return {
+      serverTimingEnabled:
+        typeof enabled === "function"
+          ? enabled
+          : enabled
+            ? SERVER_TIMING_ENABLED
+            : SERVER_TIMING_DISABLED,
+      serverTimingMinDuration: minDuration,
+    };
+  }
+  return {
+    serverTimingEnabled: serverTiming
+      ? SERVER_TIMING_ENABLED
+      : SERVER_TIMING_DISABLED,
+    serverTimingMinDuration: 0,
+  };
+};