effect 4.0.4 → 4.0.6

package/src/http/HttpIncomingMessage.ts

@@ -145,37 +145,17 @@ export const MaxBodySize = Context.Reference<ByteSize.ByteSize | undefined>(
 )
 
 /**
- * Builds an inspectable object for an incoming message, redacting headers and including a synchronously readable JSON or text body when available.
+ * Builds an inspectable object for an incoming message and redacts headers.
+ * The body is left unread.
  *
  * @stability unstable
  * @category converting
  * @since 4.0.0
  */
 export const inspect = <E>(self: HttpIncomingMessage<E>, that: object): object => {
-  const contentType = self.headers["content-type"] ?? ""
-  let body: unknown
-  if (contentType.includes("application/json")) {
-    try {
-      body = Effect.runSync(self.json)
-      // oxlint-disable-next-line @typescript-eslint/no-unused-vars
-    } catch (_) {
-      //
-    }
-  } else if (contentType.includes("text/") || contentType.includes("urlencoded")) {
-    try {
-      body = Effect.runSync(self.text)
-      // oxlint-disable-next-line @typescript-eslint/no-unused-vars
-    } catch (_) {
-      //
-    }
-  }
-  const obj: any = {
+  return {
     ...that,
     headers: redact(self.headers),
     remoteAddress: self.remoteAddress
   }
-  if (body !== undefined) {
-    obj.body = body
-  }
-  return obj
 }

package/src/http/HttpMiddleware.ts

@@ -11,6 +11,7 @@
  * @stability unstable
  * @since 4.0.0
  */
+import * as ByteSize from "../ByteSize.ts"
 import * as Cause from "../Cause.ts"
 import { Clock } from "../Clock.ts"
 import * as Context from "../Context.ts"
@@ -21,11 +22,15 @@ import { constant, constFalse } from "../Function.ts"
 import * as internalEffect from "../internal/effect.ts"
 import { getStackTraceLimit, setStackTraceLimit } from "../internal/stackTraceLimit.ts"
 import * as Layer from "../Layer.ts"
+import * as IpNetwork from "../net/IpNetwork.ts"
+import * as NetAddress from "../net/NetAddress.ts"
 import * as Option from "../Option.ts"
 import type { Predicate } from "../Predicate.ts"
 import type { ReadonlyRecord } from "../Record.ts"
+import * as Result from "../Result.ts"
 import { nativeTracer, ParentSpan, Tracer } from "../Tracer.ts"
 import * as Headers from "./Headers.ts"
+import { hasBody } from "./HttpMethod.ts"
 import type { CompressionAlgorithm } from "./HttpPlatform.ts"
 import { HttpPlatform } from "./HttpPlatform.ts"
 import { causeResponseStripped, ClientAbort, HttpServerError, ResponseError } from "./HttpServerError.ts"
@@ -35,9 +40,11 @@ import * as Response from "./HttpServerResponse.ts"
 import type { HttpServerResponse } from "./HttpServerResponse.ts"
 import * as TraceContext from "./HttpTraceContext.ts"
 import * as compressionInternal from "./internal/compression.ts"
+import * as decompressionInternal from "./internal/decompression.ts"
 import * as bodyInternal from "./internal/httpBody.ts"
-import { appendPreResponseHandlerUnsafe } from "./internal/preResponseHandler.ts"
+import { appendPreResponseHandlerUnsafe, CurrentRequestState } from "./internal/requestState.ts"
 import * as tracing from "./internal/tracing.ts"
+import * as UrlParams from "./UrlParams.ts"
 
 /**
  * Middleware that transforms an HTTP server app effect into another HTTP server app effect.
@@ -72,14 +79,62 @@ export declare namespace HttpMiddleware {
 /**
  * Defines an `HttpMiddleware` while preserving its precise type.
  *
+ * **Gotchas**
+ *
+ * TypeScript cannot infer the `app` parameter of an `Effect.fn` or
+ * `Effect.fnUntraced` generator passed directly to `make`, so `app` becomes
+ * `any` and the middleware loses the app's error and service types. Prefer an
+ * arrow function, as in the first example. To use `Effect.fn`, declare `E`
+ * and `R` type parameters and annotate `app` with them.
+ *
+ * **Example** (Defining middleware)
+ *
+ * ```ts import.meta.vitest
+ * import { Effect } from "effect"
+ * import { HttpMiddleware, HttpServerResponse } from "effect/http"
+ *
+ * const withHeader = HttpMiddleware.make((app) =>
+ *   Effect.gen(function*() {
+ *     const response = yield* app
+ *     return HttpServerResponse.setHeader(response, "x-service", "example")
+ *   })
+ * )
+ *
+ * const app: Effect.Effect<HttpServerResponse.HttpServerResponse, "Unauthorized"> =
+ *   Effect.fail("Unauthorized")
+ *
+ * // Effect<HttpServerResponse, "Unauthorized", HttpServerRequest>
+ * const withHeaderApp = withHeader(app)
+ * ```
+ *
+ * **Example** (Defining middleware with Effect.fn)
+ *
+ * ```ts import.meta.vitest
+ * import { Effect } from "effect"
+ * import { HttpMiddleware, HttpServerResponse } from "effect/http"
+ *
+ * const withHeader = HttpMiddleware.make(
+ *   Effect.fn("withHeader")(function*<E, R>(
+ *     app: Effect.Effect<HttpServerResponse.HttpServerResponse, E, R>
+ *   ) {
+ *     const response = yield* app
+ *     return HttpServerResponse.setHeader(response, "x-service", "example")
+ *   })
+ * )
+ *
+ * const app: Effect.Effect<HttpServerResponse.HttpServerResponse, "Unauthorized"> =
+ *   Effect.fail("Unauthorized")
+ *
+ * // Effect<HttpServerResponse, "Unauthorized", never>
+ * const withHeaderApp = withHeader(app)
+ * ```
+ *
  * @stability unstable
  * @category constructors
  * @since 4.0.0
  */
 export const make = <M extends HttpMiddleware>(middleware: M): M => middleware
 
-const loggerDisabledRequests = new WeakSet<object>()
-
 const stripSearchAndHash = (url: string): string => {
   const queryIndex = url.indexOf("?")
   const hashIndex = url.indexOf("#")
@@ -102,8 +157,8 @@ const stripSearchAndHash = (url: string): string => {
  */
 export const withLoggerDisabled = <A, E, R>(self: Effect.Effect<A, E, R>): Effect.Effect<A, E, R | HttpServerRequest> =>
   Effect.withFiber((fiber) => {
-    const request = Context.getUnsafe(fiber.context, HttpServerRequest)
-    loggerDisabledRequests.add(request.source)
+    const state = Context.getOrUndefined(fiber.context, CurrentRequestState)
+    if (state !== undefined) state.loggerDisabled = true
     return self
   })
 
@@ -176,10 +231,11 @@ export const logger: <E, R>(
 ) => Effect.Effect<HttpServerResponse, E, HttpServerRequest | R> = make((httpApp) =>
   Effect.withFiber((fiber) => {
     const request = Context.getUnsafe(fiber.context, HttpServerRequest)
+    const state = Context.getOrUndefined(fiber.context, CurrentRequestState)
     const path = stripSearchAndHash(request.url)
     return Effect.withLogSpan(
       Effect.flatMap(Effect.exit(httpApp), (exit) => {
-        if (loggerDisabledRequests.has(request.source)) {
+        if (state?.loggerDisabled) {
           return exit
         } else if (exit._tag === "Failure") {
           const [response, cause] = causeResponseStripped(exit.cause)
@@ -286,11 +342,7 @@ export const tracer: <E, R>(
         span.attribute("http.request.method", request.method)
         const url = Request.toURL(request)
         if (Option.isSome(url)) {
-          if (!request.url.startsWith("/") && (url.value.username !== "" || url.value.password !== "")) {
-            url.value.username = "REDACTED"
-            url.value.password = "REDACTED"
-          }
-          tracing.addUrlAttributes(span, url.value)
+          tracing.addUrlAttributes(span, url.value, fiber.getRef(UrlParams.CurrentRedactedNames))
         }
         if (request.headers["user-agent"] !== undefined) {
           span.attribute("user_agent.original", request.headers["user-agent"])
@@ -310,25 +362,131 @@ export const tracer: <E, R>(
 )
 
 /**
- * Middleware that trusts `X-Forwarded-Host` and `X-Forwarded-For`, updating the request host header and remote address.
+ * Options for `xForwardedHeaders`.
+ *
+ * **Details**
+ *
+ * `trustedProxies` is a list of networks or a predicate that decides whether an
+ * address belongs to a proxy you operate. IPv4-mapped IPv6 addresses are
+ * converted to IPv4 before matching.
  *
  * @stability unstable
  * @category proxying
  * @since 4.0.0
  */
-export const xForwardedHeaders = make((httpApp) =>
-  Effect.updateService(httpApp, HttpServerRequest, (request) =>
-    request.headers["x-forwarded-host"]
-      ? request.modify({
-        headers: Headers.set(
-          request.headers,
-          "host",
-          request.headers["x-forwarded-host"]
-        ),
-        remoteAddress: Option.fromNullishOr(request.headers["x-forwarded-for"]?.split(",")[0].trim())
-      })
-      : request)
-)
+export interface TrustedProxyOptions {
+  readonly trustedProxies: ReadonlyArray<IpNetwork.IpNetwork> | Predicate<NetAddress.IpAddress>
+}
+
+/**
+ * Creates middleware that applies `X-Forwarded-For`, `X-Forwarded-Host`, and
+ * `X-Forwarded-Proto` sent by trusted proxies.
+ *
+ * **When to use**
+ *
+ * Use when the app runs behind proxies that append to `X-Forwarded-For`, such
+ * as most load balancers and TLS terminators.
+ *
+ * **Details**
+ *
+ * Headers are ignored unless the original transport peer
+ * (`request.peerAddress`) is trusted. `X-Forwarded-For` is then walked from
+ * the right, skipping trusted proxies. The first untrusted address becomes
+ * `remoteAddress`. When every address is trusted, the leftmost one is used. An
+ * entry that is not an IP address, such as `unknown`, stops the walk and
+ * leaves the request unchanged.
+ *
+ * `X-Forwarded-Host` and `X-Forwarded-Proto` are only used when they list one
+ * value per `X-Forwarded-For` entry; the value at the selected position
+ * replaces the `host` header and sets `protocol` (`http` or `https`), which
+ * `HttpServerRequest.toURL` uses. Otherwise the transport values are kept.
+ *
+ * `request.peerAddress` keeps the transport peer after `remoteAddress` is
+ * replaced.
+ *
+ * **Example** (Reading the client address behind a load balancer)
+ *
+ * ```ts import.meta.vitest
+ * import { Effect, Option } from "effect"
+ * import { HttpMiddleware, HttpServerRequest, HttpServerResponse } from "effect/http"
+ * import { IpNetwork } from "effect/net"
+ *
+ * const app = HttpServerRequest.HttpServerRequest.use((request) =>
+ *   Effect.succeed(HttpServerResponse.text(Option.getOrElse(request.remoteAddress, () => "unknown")))
+ * ).pipe(
+ *   HttpMiddleware.xForwardedHeaders({
+ *     trustedProxies: [IpNetwork.fromStringUnsafe("10.0.0.0/8")]
+ *   })
+ * )
+ *
+ * // The load balancer at 10.0.0.1 appended the client address to a spoofed entry
+ * const request = HttpServerRequest.fromWeb(
+ *   new Request("http://app.test/", { headers: { "x-forwarded-for": "6.6.6.6, 198.51.100.7" } })
+ * ).modify({ remoteAddress: Option.some("10.0.0.1") })
+ *
+ * const response = await Effect.runPromise(
+ *   Effect.provideService(app, HttpServerRequest.HttpServerRequest, request)
+ * )
+ * await HttpServerResponse.toWeb(response).text() // => "198.51.100.7"
+ * ```
+ *
+ * @stability unstable
+ * @category proxying
+ * @since 4.0.0
+ */
+export const xForwardedHeaders = (options: TrustedProxyOptions): HttpMiddleware => {
+  const { trustedProxies } = options
+  const isTrusted: Predicate<NetAddress.IpAddress> = typeof trustedProxies === "function"
+    ? trustedProxies
+    : (address) => trustedProxies.some((network) => IpNetwork.contains(network, address))
+  return make((httpApp) =>
+    Effect.updateService(httpApp, HttpServerRequest, (request) => applyXForwarded(request, isTrusted))
+  )
+}
+
+const applyXForwarded = (request: HttpServerRequest, isTrusted: Predicate<NetAddress.IpAddress>): HttpServerRequest => {
+  const peer = parseForwardedAddress(Option.getOrUndefined(request.peerAddress))
+  if (peer === undefined || !isTrusted(peer)) return request
+  const addresses = splitList(request.headers["x-forwarded-for"])
+  if (addresses === undefined) return request
+  for (let index = addresses.length - 1; index >= 0; index--) {
+    const address = parseForwardedAddress(addresses[index])
+    if (address === undefined) return request
+    if (index > 0 && isTrusted(address)) continue
+    const host = alignedValue(request.headers["x-forwarded-host"], addresses.length, index)
+    const protocol = alignedValue(request.headers["x-forwarded-proto"], addresses.length, index)?.toLowerCase()
+    return request.modify({
+      remoteAddress: Option.some(NetAddress.formatIp(address)),
+      peerAddress: request.peerAddress,
+      ...(host !== undefined && isValidHost(host) ? { headers: Headers.set(request.headers, "host", host) } : {}),
+      ...(protocol === "http" || protocol === "https" ? { protocol } : {})
+    })
+  }
+  return request
+}
+
+const splitList = (value: string | undefined): Array<string> | undefined => value?.split(",").map((_) => _.trim())
+
+// Host and proto lists are only associated with a hop when they have one value
+// per `X-Forwarded-For` entry.
+const alignedValue = (header: string | undefined, length: number, index: number): string | undefined => {
+  const values = splitList(header)
+  return values?.length === length ? values[index] : undefined
+}
+
+const parseForwardedAddress = (input: string | undefined): NetAddress.IpAddress | undefined => {
+  if (input === undefined) return undefined
+  const ip = NetAddress.ipFromString(input.startsWith("[") && input.endsWith("]") ? input.slice(1, -1) : input)
+  if (Result.isSuccess(ip)) return NetAddress.toCanonical(ip.success)
+  const inet = NetAddress.inetAddressFromString(input)
+  return Result.isSuccess(inet) ? NetAddress.toCanonical(inet.success.address) : undefined
+}
+
+const hostShape = /^(?:\[[0-9a-f:.]+\]|[a-z0-9._-]+)(?::\d{1,5})?$/i
+
+// The shape check rules out paths, userinfo and lists; the URL parser rejects
+// invalid IP literals and out-of-range ports, matching what `toURL` accepts.
+const isValidHost = (host: string): boolean => hostShape.test(host) && URL.canParse(`http://${host}`)
 
 /**
  * Middleware that parses the current request URL's search parameters and provides them as `ParsedSearchParams`.
@@ -487,7 +645,7 @@ export const cors = (options?: {
           headers: headersFromRequestOptions(request)
         }))
       }
-      appendPreResponseHandlerUnsafe(request, preResponseHandler)
+      appendPreResponseHandlerUnsafe(fiber.context, preResponseHandler)
       return httpApp
     })
 }
@@ -618,14 +776,93 @@ export const compression = (
     httpApp: Effect.Effect<HttpServerResponse, E, R>
   ): Effect.Effect<HttpServerResponse, E, R | HttpServerRequest | HttpPlatform> =>
     Effect.withFiber((fiber) => {
-      const request = Context.getUnsafe(fiber.context, HttpServerRequest)
       const compression = Context.getUnsafe(fiber.context, HttpPlatform).compression
-      appendPreResponseHandlerUnsafe(request, (request, response) =>
+      appendPreResponseHandlerUnsafe(fiber.context, (request, response) =>
         transform(compression, request.headers["accept-encoding"], response))
       return httpApp
     })
 }
 
+/**
+ * Middleware that decompresses request bodies sent with a `Content-Encoding`
+ * of `gzip` or `deflate`.
+ *
+ * **Details**
+ *
+ * The request service is replaced with a view whose body accessors (`stream`,
+ * `text`, `json`, `arrayBuffer`, `urlParamsBody`, `multipart`) yield the
+ * decompressed body, and whose headers no longer include `Content-Encoding`
+ * or `Content-Length`. Decompression is lazy and only happens when the body
+ * is read. Stacked codings such as `deflate, gzip` are undone in reverse
+ * order, and `identity` members are ignored.
+ *
+ * Requests whose `Content-Encoding` includes any other coding are rejected
+ * with `415 Unsupported Media Type` and `Accept-Encoding: gzip, deflate`,
+ * without running the app. Malformed compressed data fails the body read
+ * with a `RequestParseError`, or a `MultipartError` with reason `Parse` when
+ * reading multipart data.
+ *
+ * The decompressed size is limited to `maxDecompressedSize`, falling back to
+ * the `MaxBodySize` reference and then to 10 MiB. Exceeding it fails the body
+ * read with a `RequestParseError`, or a `MultipartError` with reason
+ * `BodyTooLarge` when reading multipart data. The limit applies to every body
+ * accessor, including `stream`.
+ *
+ * Decompression uses the global `DecompressionStream`. `deflate` means the
+ * zlib format (RFC 1950); raw deflate data is rejected.
+ *
+ * **Gotchas**
+ *
+ * `request.source` is still the original, compressed request.
+ * `HttpServerRequest.toWeb` returns that compressed request only when the
+ * source is a Web `Request`. On other platforms, such as Node, it builds a new
+ * `Request` from the decompressed body and the stripped headers.
+ *
+ * @stability unstable
+ * @category compression
+ * @since 4.0.0
+ */
+export const decompression = (
+  options?: {
+    /**
+     * Maximum number of decompressed body bytes. Defaults to the
+     * `MaxBodySize` reference, or 10 MiB when that is unset.
+     */
+    readonly maxDecompressedSize?: ByteSize.Input | undefined
+  } | undefined
+): <E, R>(
+  httpApp: Effect.Effect<HttpServerResponse, E, R>
+) => Effect.Effect<HttpServerResponse, E, R | HttpServerRequest> => {
+  const maxDecompressedSize = options?.maxDecompressedSize === undefined
+    ? undefined
+    : ByteSize.fromInputUnsafe(options.maxDecompressedSize)
+  return <E, R>(
+    httpApp: Effect.Effect<HttpServerResponse, E, R>
+  ): Effect.Effect<HttpServerResponse, E, R | HttpServerRequest> =>
+    Effect.withFiber((fiber) => {
+      const request = Context.getUnsafe(fiber.context, HttpServerRequest)
+      const contentEncoding = request.headers["content-encoding"]
+      if (contentEncoding === undefined || !hasBody(request.method)) {
+        return httpApp
+      }
+      const codings = decompressionInternal.parseContentEncoding(contentEncoding)
+      if (codings === undefined) {
+        return Effect.succeed(Response.empty({
+          status: 415,
+          headers: { "accept-encoding": "gzip, deflate" }
+        }))
+      }
+      if (codings.length === 0) {
+        return httpApp
+      }
+      return Effect.provideService(
+        httpApp,
+        HttpServerRequest,
+        new decompressionInternal.DecompressedRequest(request, codings, maxDecompressedSize)
+      )
+    })
+}
+
 const withVary = (response: HttpServerResponse): HttpServerResponse => {
   const vary = compressionInternal.varyWith(response.headers, "Accept-Encoding")
   return Response.setHeader(response, "vary", vary)

package/src/http/HttpRouter.ts

@@ -24,6 +24,7 @@ import * as Scope from "../Scope.ts"
 import * as Tracer from "../Tracer.ts"
 import type * as Types from "../Types.ts"
 import * as FindMyWay from "./FindMyWay.ts"
+import { getClosingParenthensePosition, getMaxParamLengthExceeded } from "./FindMyWay/internal/router.ts"
 import * as HttpEffect from "./HttpEffect.ts"
 import * as HttpIncomingMessage from "./HttpIncomingMessage.ts"
 import type * as HttpMethod from "./HttpMethod.ts"
@@ -123,7 +124,12 @@ export const HttpRouter: Context.Service<HttpRouter, HttpRouter> = Context.Servi
  * @since 4.0.0
  */
 export const make = Effect.gen(function*() {
-  const router = FindMyWay.make<Route<any, never>>(yield* RouterConfig)
+  const config = yield* RouterConfig
+  const ignoreDuplicateSlashes = config.ignoreDuplicateSlashes ?? true
+  const router = FindMyWay.make<{
+    readonly route: Route<any, never>
+    readonly prefixSegments: number | undefined
+  }>(config)
   const middleware = new Set<middleware.Fn>()
 
   const addAll = <const Routes extends ReadonlyArray<Route<any, any>>>(
@@ -147,19 +153,25 @@ export const make = Effect.gen(function*() {
           ...routes[i],
           handler: applyMiddleware(routes[i].handler as Effect.Effect<HttpServerResponse.HttpServerResponse>)
         })
+        const handler = {
+          route: route as Route<any, never>,
+          prefixSegments: Option.isSome(route.prefix)
+            ? countSegments(route.prefix.value, ignoreDuplicateSlashes)
+            : undefined
+        }
         if (route.method === "*") {
           if (route.path.endsWith("/*")) {
-            router.all(route.path, route as any)
-            router.all(route.path.slice(0, -2) as any, route as any)
+            router.all(route.path, handler)
+            router.all(route.path.slice(0, -2) as any, handler)
           } else {
-            router.all(route.path, route as any)
+            router.all(route.path, handler)
           }
         } else {
           if (route.path.endsWith("/*")) {
-            router.on(route.method, route.path, route as any)
-            router.on(route.method, route.path.slice(0, -2) as any, route as any)
+            router.on(route.method, route.path, handler)
+            router.on(route.method, route.path.slice(0, -2) as any, handler)
           } else {
-            router.on(route.method, route.path, route as any)
+            router.on(route.method, route.path, handler)
           }
         }
       }
@@ -201,22 +213,28 @@ export const make = Effect.gen(function*() {
         let context = fiber.context
         const request = Context.getUnsafe(context, HttpServerRequest.HttpServerRequest)
         let result = router.find(request.method, request.url)
+        let paramLimit = result === undefined ? getMaxParamLengthExceeded(router) : undefined
         if (result === undefined && request.method === "HEAD") {
           result = router.find("GET", request.url)
+          paramLimit ??= getMaxParamLengthExceeded(router)
         }
         if (result === undefined) {
           return Effect.fail(
             new HttpServerError.HttpServerError({
-              reason: new HttpServerError.RouteNotFound({ request })
+              reason: new HttpServerError.RouteNotFound(
+                paramLimit === undefined
+                  ? { request }
+                  : { request, description: `path parameter is longer than maxParamLength (${paramLimit})` }
+              )
             })
           )
         }
-        const route = result.handler
-        if (Option.isSome(route.prefix)) {
+        const { route, prefixSegments } = result.handler
+        if (prefixSegments !== undefined) {
           context = Context.add(
             context,
             HttpServerRequest.HttpServerRequest,
-            sliceRequestUrl(request, route.prefix.value)
+            sliceRequestUrl(request, prefixSegments, ignoreDuplicateSlashes)
           )
         }
         context = Context.add(context, HttpServerRequest.ParsedSearchParams, result.searchParams)
@@ -251,9 +269,44 @@ export const make = Effect.gen(function*() {
   })
 })
 
-function sliceRequestUrl(request: HttpServerRequest.HttpServerRequest, prefix: string) {
-  const prefexLen = prefix.length
-  return request.modify({ url: request.url.length <= prefexLen ? "/" : request.url.slice(prefexLen) })
+function sliceRequestUrl(
+  request: HttpServerRequest.HttpServerRequest,
+  prefixSegments: number,
+  ignoreDuplicateSlashes: boolean
+) {
+  const url = request.url
+  let index = 0
+  for (let segments = prefixSegments; segments > 0; segments--) {
+    if (ignoreDuplicateSlashes) {
+      while (url[index] === "/") index++
+    } else if (url[index] === "/") {
+      index++
+    }
+    while (index < url.length && !"/?;#".includes(url[index])) index++
+  }
+  return request.modify({ url: index < url.length ? url.slice(index) : "/" })
+}
+
+function countSegments(prefix: string, ignoreDuplicateSlashes: boolean) {
+  let count = 0
+  let inParamName = false
+  for (let i = 0; i < prefix.length; i++) {
+    const char = prefix[i]
+    if (char === "/") {
+      if (!ignoreDuplicateSlashes || prefix[i - 1] !== "/") count++
+      inParamName = false
+    } else if (char === ":") {
+      if (prefix[i + 1] === ":") i++
+      else inParamName = true
+    } else if (char === "-" || char === ".") {
+      inParamName = false
+    } else if (char === "(" && inParamName) {
+      // Slashes inside parameter regexes are not segment boundaries.
+      i = getClosingParenthensePosition(prefix, i)
+      inParamName = false
+    }
+  }
+  return count
 }
 
 /**

package/src/http/HttpServerError.ts

@@ -23,6 +23,7 @@ import { hasProperty } from "../Predicate.ts"
 import type * as Request from "./HttpServerRequest.ts"
 import * as Respondable from "./HttpServerRespondable.ts"
 import * as Response from "./HttpServerResponse.ts"
+import * as UrlParams from "./UrlParams.ts"
 
 const TypeId = "~effect/http/HttpServerError"
 
@@ -85,7 +86,8 @@ export class HttpServerError extends Data.TaggedError("HttpServerError")<{
  *
  * **Details**
  *
- * When converted to a response it produces an empty `400` response.
+ * When converted to a response it produces an empty `413` response for
+ * `BodyTooLarge`, or an empty `400` response for other parse failures.
  *
  * @stability unstable
  * @category errors
@@ -93,21 +95,23 @@ export class HttpServerError extends Data.TaggedError("HttpServerError")<{
  */
 export class RequestParseError extends Data.TaggedError("RequestParseError")<{
   readonly request: Request.HttpServerRequest
+  readonly reason?: "Parse" | "BodyTooLarge"
   readonly description?: string
   readonly cause?: unknown
 }> implements Respondable.Respondable {
   /**
-   * Converts the request error into a `400 Bad Request` response.
+   * Converts the request error into a `413 Content Too Large` response for body
+   * size breaches, or a `400 Bad Request` response for other parse failures.
    *
    * @stability unstable
    * @since 4.0.0
    */
   [Respondable.symbol]() {
-    return Effect.succeed(Response.empty({ status: 400 }))
+    return Effect.succeed(Response.empty({ status: this.reason === "BodyTooLarge" ? 413 : 400 }))
   }
 
   get methodAndUrl() {
-    return `${this.request.method} ${this.request.url}`
+    return formatMethodAndUrl(this.request)
   }
 
   override get message() {
@@ -139,7 +143,7 @@ export class RouteNotFound extends Data.TaggedError("RouteNotFound")<{
   override readonly [ErrorReporter.ignore] = true
 
   get methodAndUrl() {
-    return `${this.request.method} ${this.request.url}`
+    return formatMethodAndUrl(this.request)
   }
 
   override get message() {
@@ -174,7 +178,7 @@ export class InternalError extends Data.TaggedError("InternalError")<{
   }
 
   get methodAndUrl() {
-    return `${this.request.method} ${this.request.url}`
+    return formatMethodAndUrl(this.request)
   }
 
   override get message() {
@@ -214,7 +218,7 @@ export class ResponseError extends Data.TaggedError("ResponseError")<{
   }
 
   get methodAndUrl() {
-    return `${this.request.method} ${this.request.url}`
+    return formatMethodAndUrl(this.request)
   }
 
   override get message() {
@@ -275,6 +279,9 @@ export class ClientAbort extends Context.Service<ClientAbort, true>()("effect/ht
   )
 }
 
+const formatMethodAndUrl = (request: Request.HttpServerRequest) =>
+  `${request.method} ${UrlParams.redactUrl(request.url)}`
+
 const formatRequestMessage = (reason: string, description: string | undefined, info: string) => {
   const prefix = `${reason} (${info})`
   return description ? `${prefix}: ${description}` : prefix