@server/next 0.48.1 → 0.48.3

package/index.js

@@ -2110,6 +2110,27 @@ function applyCors(res, ctx) {
   }
 }
 
+// src/helpers/forwarded.ts
+var first2 = (value) => {
+  const one = Array.isArray(value) ? value[0] : value;
+  return one?.split(",")[0].trim() || void 0;
+};
+function forwarded(url, headers2, trustProxy) {
+  if (!trustProxy) return;
+  const proto = first2(headers2["x-forwarded-proto"]);
+  if (proto === "http" || proto === "https") url.protocol = `${proto}:`;
+  const host = first2(headers2["x-forwarded-host"]);
+  const port = first2(headers2["x-forwarded-port"]);
+  if (host?.includes(":")) {
+    url.host = host;
+  } else if (host) {
+    url.hostname = host;
+    url.port = port ?? "";
+  } else if (port) {
+    url.port = port;
+  }
+}
+
 // src/helpers/createWebsocket.ts
 function createWebsocket(sockets, handlers) {
   const run2 = (event, socket, body) => {
@@ -2477,7 +2498,7 @@ function parseRange(header, size) {
 }
 
 // src/middle/assets.ts
-var CACHE_CONTROL = "public, max-age=3600";
+var DEFAULT_CACHE = "public, max-age=3600";
 async function assets(ctx) {
   if (!ctx.options.public) return;
   if (ctx.method !== "get" && ctx.method !== "head") return;
@@ -2490,7 +2511,9 @@ async function assets(ctx) {
     if (info ? !meta2 : !await file2.exists()) return;
     const ext = ctx.url.pathname.split(".").pop()?.toLowerCase();
     const ctype = ext && mimes_default[ext] || meta2?.type || ext;
-    const headers2 = { "cache-control": CACHE_CONTROL };
+    const headers2 = {
+      "cache-control": resolveCache(ctx.options.cache) ?? DEFAULT_CACHE
+    };
     let tag;
     if (meta2) {
       const stamp = meta2.modified ? meta2.modified.getTime() : 0;
@@ -2906,6 +2929,7 @@ async function createNode(req, app, signal = new AbortController().signal) {
   const path = (req.url || "/").replace(/\/$/, "") || "/";
   const baseUrl = `${scheme}://${host}`;
   const url = new URL(path, baseUrl);
+  forwarded(url, headers2, app.settings.security.trustProxy);
   define(
     url,
     "query",
@@ -2949,6 +2973,7 @@ async function createWinter(req, app, server2) {
   const cookies2 = parseCookies(headers2.cookie);
   const baseUrl = req.url.replace(/\/$/, "") || "/";
   const url = new URL(baseUrl);
+  forwarded(url, headers2, app.settings.security.trustProxy);
   define(
     url,
     "query",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@server/next",
-  "version": "0.48.1",
+  "version": "0.48.3",
   "description": "A fully-fledged web server with routing, file uploads, sessions, static files, schema validation, websockets, testing, etc.",
   "homepage": "https://server-js.com/",
   "repository": "github:franciscop/server-next",