@server/next 0.33.0 → 0.34.1

package/index.d.ts

@@ -1,3 +1,5 @@
+import * as http from 'http';
+
 type LimitOptions = {
     maxSize?: number | string;
     minSize?: number | string;
@@ -129,9 +131,20 @@ type Logger = {
 };
 type SecurityOptions = {
     trustProxy?: boolean;
+    frameguard?: boolean | string;
+    noSniff?: boolean;
+    referrerPolicy?: boolean | string;
+    hsts?: boolean | string;
+    xssProtection?: boolean;
+    csp?: boolean | string;
+    coop?: boolean | string;
+    corp?: boolean | string;
+    permissionsPolicy?: string;
 };
 type SecuritySettings = {
     trustProxy: boolean;
+    headers: Record<string, string>;
+    hsts: string | null;
 };
 type OnError = (error: Error, ctx: Context) => Response | Promise<Response>;
 type Options = {
@@ -150,7 +163,7 @@ type Options = {
     onError?: OnError;
     log?: LogLevel | boolean;
     favicon?: string | Bucket;
-    security?: SecurityOptions;
+    security?: boolean | SecurityOptions;
     body?: BodyMode;
 };
 type Settings = {
@@ -332,7 +345,7 @@ declare class Server<O extends ServerConfig = {}> extends Router<O> {
     port?: number;
     constructor(options?: Options);
     self(): this;
-    node(): Promise<void>;
+    node(): Promise<http.Server<typeof http.IncomingMessage, typeof http.ServerResponse>>;
     fetch(request: Request, env?: BunEnv): Promise<Response>;
     callback(request: Request, context: unknown): Promise<Response>;
     test(): {

package/index.js

@@ -1358,6 +1358,47 @@ function createLogger(level) {
   };
 }
 
+// src/helpers/security.ts
+function resolveSecurity(security) {
+  const off = security === false;
+  const o = security && typeof security === "object" ? security : {};
+  const val = (v, def) => v === false ? null : v === true || v == null ? def : v;
+  const map2 = off ? {} : {
+    "x-frame-options": val(o.frameguard, "SAMEORIGIN"),
+    "x-content-type-options": o.noSniff === false ? null : "nosniff",
+    "referrer-policy": val(
+      o.referrerPolicy,
+      "strict-origin-when-cross-origin"
+    ),
+    "x-xss-protection": o.xssProtection === false ? null : "0",
+    // Opt-in: default off
+    "content-security-policy": val(o.csp, null),
+    "cross-origin-opener-policy": val(o.coop, null),
+    "cross-origin-resource-policy": val(o.corp, null),
+    "permissions-policy": o.permissionsPolicy ?? null
+  };
+  const headers2 = {};
+  for (const key in map2) {
+    const value = map2[key];
+    if (value) headers2[key] = value;
+  }
+  return {
+    trustProxy: o.trustProxy ?? true,
+    headers: headers2,
+    hsts: off ? null : val(o.hsts, "max-age=15552000; includeSubDomains")
+  };
+}
+function applySecurity(res, ctx) {
+  const security = ctx.options.security;
+  if (!security) return;
+  for (const key in security.headers) {
+    if (!res.headers.has(key)) res.headers.set(key, security.headers[key]);
+  }
+  if (security.hsts && ctx.platform.production && !res.headers.has("strict-transport-security")) {
+    res.headers.set("strict-transport-security", security.hsts);
+  }
+}
+
 // src/helpers/config.ts
 function config(options = {}) {
   const env2 = globalThis.env;
@@ -1371,11 +1412,9 @@ function config(options = {}) {
     // How request bodies are read: parsed into ctx.body by default; `raw` keeps
     // the Buffer, `stream` hands the handler the unread web ReadableStream.
     body: options.body ?? "parse",
-    // Trust X-Forwarded-* headers for ctx.ip (on by default; set it to false
-    // when clients connect directly so a client can't spoof its IP).
-    security: {
-      trustProxy: options.security?.trustProxy ?? true
-    }
+    // Secure-by-default response headers + trustProxy for ctx.ip. `false` turns
+    // the added headers off; see resolveSecurity for the defaults.
+    security: resolveSecurity(options.security)
   };
   options.cors = options.cors || env2.CORS || null;
   if (options.cors) {
@@ -1600,6 +1639,7 @@ async function parseResponse(out, ctx) {
     throw new Error(`Invalid response type ${out}`);
   }
   applyCors(out, ctx);
+  applySecurity(out, ctx);
   if (ctx.time?.times?.length > 1) {
     out.headers.set("Server-Timing", ctx.time.headers());
   }
@@ -1756,6 +1796,7 @@ async function getResponse(app, ctx) {
   } catch (error) {
     const res = await ctx.options.onError(error, ctx);
     applyCors(res, ctx);
+    applySecurity(res, ctx);
     return res;
   }
 }
@@ -2484,25 +2525,26 @@ var Winter = async (app, request, env2) => {
 };
 var Node = async (app) => {
   const http = await import("http");
-  http.createServer(async (request, response) => {
-    const ctx = await createNode(request, app);
-    if ("error" in ctx) throw ctx.error;
-    const out = await handleRequest(app, ctx);
-    response.writeHead(out.status || 200, parseHeaders_default(out.headers));
-    if (out.body instanceof ReadableStream) {
-      await iterate(out.body, (chunk) => response.write(chunk));
-    } else {
-      response.write(out.body || "");
+  const { attachWebsocket } = await import("./wsNode-GEJUCJQ7.js");
+  const server2 = http.createServer(
+    async (request, response) => {
+      const ctx = await createNode(request, app);
+      if ("error" in ctx) throw ctx.error;
+      const out = await handleRequest(app, ctx);
+      response.writeHead(out.status || 200, parseHeaders_default(out.headers));
+      if (out.body instanceof ReadableStream) {
+        await iterate(out.body, (chunk) => response.write(chunk));
+      } else {
+        response.write(out.body || "");
+      }
+      response.end();
     }
-    response.end();
-  }).listen(app.settings.port, () => {
+  );
+  attachWebsocket(server2, app);
+  server2.listen(app.settings.port, () => {
     app.settings.log.start(`http://localhost:${app.settings.port}/`);
-    if (app.handlers.socket.length) {
-      console.warn(
-        "[server] WebSockets (.socket()) are only supported on Bun, not Node"
-      );
-    }
   });
+  return server2;
 };
 var Netlify = async (app, request, context) => {
   request.context = context;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@server/next",
-  "version": "0.33.0",
+  "version": "0.34.1",
   "description": "A fully-fledged web server with routing, file uploads, sessions, static files, schema validation, websockets, testing, etc.",
   "homepage": "https://server-js.com/",
   "repository": "github:franciscop/server-next",