effect 4.0.5 → 4.0.7

package/src/http/HttpServerRequest.ts

@@ -35,6 +35,7 @@ import * as HttpIncomingMessage from "./HttpIncomingMessage.ts"
 import { hasBody, type HttpMethod } from "./HttpMethod.ts"
 import { HttpServerError, type RequestError, RequestParseError } from "./HttpServerError.ts"
 import * as bodyInternal from "./internal/httpBody.ts"
+import * as lazyStream from "./internal/lazyStream.ts"
 import * as Multipart from "./Multipart.ts"
 import * as UrlParams from "./UrlParams.ts"
 
@@ -72,8 +73,13 @@ export const TypeId = "~effect/http/HttpServerRequest"
  * **Details**
  *
  * It extends `HttpIncomingMessage` with request metadata, parsed cookies,
- * multipart accessors, WebSocket upgrade support, and a `modify` method for
- * creating adjusted request views.
+ * multipart accessors, connection upgrades, and a `modify` method for
+ * creating adjusted request views. `upgrade` completes a WebSocket handshake
+ * for `Upgrade: websocket`. Platforms that can hand over the connection, such
+ * as Node, answer other protocols with `101 Switching Protocols` and expose
+ * the raw connection. `upgradeWith` does the same and adds custom headers to
+ * the `101` response; `upgrade` is `upgradeWith({})`. WebSocket upgrades fail
+ * when custom headers are given.
  *
  * @stability unstable
  * @category models
@@ -95,12 +101,30 @@ export interface HttpServerRequest extends HttpIncomingMessage.HttpIncomingMessa
   readonly multipartStream: Stream.Stream<Multipart.Part, Multipart.MultipartError>
 
   readonly upgrade: Effect.Effect<Socket.Socket, HttpServerError>
+  readonly upgradeWith: (options: {
+    readonly headers?: Headers.Input | undefined
+  }) => Effect.Effect<Socket.Socket, HttpServerError>
+
+  /**
+   * Address of the directly connected peer. Trusted proxy middleware replaces
+   * `remoteAddress` with the forwarded client address and keeps the previous
+   * value here; otherwise it equals `remoteAddress`.
+   */
+  readonly peerAddress: Option.Option<string>
+
+  /**
+   * Scheme validated by trusted proxy middleware. `toURL` prefers it over the
+   * scheme of the transport connection.
+   */
+  readonly protocol: "http" | "https" | undefined
 
   readonly modify: (
     options: {
       readonly url?: string
       readonly headers?: Headers.Headers
       readonly remoteAddress?: Option.Option<string>
+      readonly peerAddress?: Option.Option<string>
+      readonly protocol?: "http" | "https"
     }
   ) => HttpServerRequest
 }
@@ -493,12 +517,16 @@ class ServerRequestImpl extends Inspectable.Class implements HttpServerRequest {
   readonly url: string
   public headersOverride?: Headers.Headers | undefined
   private remoteAddressOverride?: Option.Option<string> | undefined
+  private peerAddressOverride?: Option.Option<string> | undefined
+  readonly protocol: "http" | "https" | undefined
 
   constructor(
     source: Request,
     url: string,
     headersOverride?: Headers.Headers,
-    remoteAddressOverride?: Option.Option<string>
+    remoteAddressOverride?: Option.Option<string>,
+    peerAddressOverride?: Option.Option<string>,
+    protocol?: "http" | "https"
   ) {
     super()
     this[TypeId] = TypeId
@@ -507,6 +535,8 @@ class ServerRequestImpl extends Inspectable.Class implements HttpServerRequest {
     this.url = url
     this.headersOverride = headersOverride
     this.remoteAddressOverride = remoteAddressOverride
+    this.peerAddressOverride = peerAddressOverride
+    this.protocol = protocol
   }
   toJSON(): unknown {
     return HttpIncomingMessage.inspect(this, {
@@ -520,13 +550,17 @@ class ServerRequestImpl extends Inspectable.Class implements HttpServerRequest {
       readonly url?: string | undefined
       readonly headers?: Headers.Headers | undefined
       readonly remoteAddress?: Option.Option<string> | undefined
+      readonly peerAddress?: Option.Option<string> | undefined
+      readonly protocol?: "http" | "https" | undefined
     }
   ) {
     return new ServerRequestImpl(
       this.source,
       options.url ?? this.url,
       options.headers ?? this.headersOverride,
-      "remoteAddress" in options ? options.remoteAddress : this.remoteAddressOverride
+      "remoteAddress" in options ? options.remoteAddress : this.remoteAddressOverride,
+      options.peerAddress ?? this.peerAddressOverride,
+      options.protocol ?? this.protocol
     )
   }
   get method(): HttpMethod {
@@ -538,6 +572,9 @@ class ServerRequestImpl extends Inspectable.Class implements HttpServerRequest {
   get remoteAddress(): Option.Option<string> {
     return this.remoteAddressOverride ?? Option.none()
   }
+  get peerAddress(): Option.Option<string> {
+    return this.peerAddressOverride ?? this.remoteAddress
+  }
   get headers(): Headers.Headers {
     this.headersOverride ??= Headers.fromInput(this.source.headers as any)
     return this.headersOverride
@@ -578,18 +615,23 @@ class ServerRequestImpl extends Inspectable.Class implements HttpServerRequest {
     if (this.textEffect) {
       return this.textEffect
     }
-    this.textEffect = Effect.runSync(Effect.cached(
-      Effect.tryPromise({
-        try: () => this.source.text(),
-        catch: (cause) =>
-          new HttpServerError({
-            reason: new RequestParseError({
-              request: this,
-              cause
+    this.textEffect = Effect.withFiber((fiber) =>
+      fiber.getRef(HttpIncomingMessage.MaxBodySize) === undefined
+        ? Effect.tryPromise({
+          try: () => this.source.text(),
+          catch: (cause) =>
+            new HttpServerError({
+              reason: new RequestParseError({
+                request: this,
+                cause
+              })
             })
-          })
-      })
-    ))
+        })
+        : Effect.map(this.arrayBuffer, (buffer) => textDecoder.decode(buffer))
+    ).pipe(
+      Effect.cached,
+      Effect.runSync
+    )
     return this.textEffect
   }
 
@@ -654,22 +696,36 @@ class ServerRequestImpl extends Inspectable.Class implements HttpServerRequest {
     if (this.arrayBufferEffect) {
       return this.arrayBufferEffect
     }
-    this.arrayBufferEffect = Effect.runSync(Effect.cached(
-      Effect.tryPromise({
-        try: () => this.source.arrayBuffer(),
+    this.arrayBufferEffect = Effect.withFiber((fiber) => {
+      const maxBodySize = fiber.getRef(HttpIncomingMessage.MaxBodySize)
+      return Effect.tryPromise({
+        try: (signal) =>
+          maxBodySize === undefined
+            ? this.source.arrayBuffer()
+            : readArrayBufferLimited(this.source, Number(maxBodySize), signal),
         catch: (cause) =>
           new HttpServerError({
             reason: new RequestParseError({
               request: this,
+              reason: cause instanceof BodyTooLargeError ? "BodyTooLarge" : "Parse",
               cause
             })
           })
       })
-    ))
+    }).pipe(
+      Effect.cached,
+      Effect.runSync
+    )
     return this.arrayBufferEffect
   }
 
   get upgrade(): Effect.Effect<Socket.Socket, HttpServerError> {
+    return this.upgradeWith({})
+  }
+
+  upgradeWith(
+    _options: { readonly headers?: Headers.Input | undefined }
+  ): Effect.Effect<Socket.Socket, HttpServerError> {
     return Effect.fail(
       new HttpServerError({
         reason: new RequestParseError({
@@ -688,6 +744,8 @@ class ClientRequestImpl extends Inspectable.Class implements HttpServerRequest {
   public originalUrl: string
   public headersOverride?: Headers.Headers | undefined
   private remoteAddressOverride?: Option.Option<string> | undefined
+  private peerAddressOverride?: Option.Option<string> | undefined
+  readonly protocol: "http" | "https" | undefined
   private urlOverride?: string | undefined
 
   constructor(
@@ -695,7 +753,9 @@ class ClientRequestImpl extends Inspectable.Class implements HttpServerRequest {
     originalUrl: string,
     urlOverride?: string,
     headersOverride?: Headers.Headers,
-    remoteAddressOverride?: Option.Option<string>
+    remoteAddressOverride?: Option.Option<string>,
+    peerAddressOverride?: Option.Option<string>,
+    protocol?: "http" | "https"
   ) {
     super()
     this[TypeId] = TypeId
@@ -705,6 +765,8 @@ class ClientRequestImpl extends Inspectable.Class implements HttpServerRequest {
     this.urlOverride = urlOverride
     this.headersOverride = headersOverride
     this.remoteAddressOverride = remoteAddressOverride
+    this.peerAddressOverride = peerAddressOverride
+    this.protocol = protocol
   }
 
   toJSON(): unknown {
@@ -720,6 +782,8 @@ class ClientRequestImpl extends Inspectable.Class implements HttpServerRequest {
       readonly url?: string | undefined
       readonly headers?: Headers.Headers | undefined
       readonly remoteAddress?: Option.Option<string> | undefined
+      readonly peerAddress?: Option.Option<string> | undefined
+      readonly protocol?: "http" | "https" | undefined
     }
   ) {
     return new ClientRequestImpl(
@@ -727,7 +791,9 @@ class ClientRequestImpl extends Inspectable.Class implements HttpServerRequest {
       this.originalUrl,
       options.url ?? this.url,
       options.headers ?? this.headersOverride,
-      "remoteAddress" in options ? options.remoteAddress : this.remoteAddressOverride
+      "remoteAddress" in options ? options.remoteAddress : this.remoteAddressOverride,
+      options.peerAddress ?? this.peerAddressOverride,
+      options.protocol ?? this.protocol
     )
   }
 
@@ -743,6 +809,10 @@ class ClientRequestImpl extends Inspectable.Class implements HttpServerRequest {
     return this.remoteAddressOverride ?? Option.none()
   }
 
+  get peerAddress(): Option.Option<string> {
+    return this.peerAddressOverride ?? this.remoteAddress
+  }
+
   get headers(): Headers.Headers {
     return this.headersOverride ??= this.source.headers
   }
@@ -870,6 +940,12 @@ class ClientRequestImpl extends Inspectable.Class implements HttpServerRequest {
   }
 
   get upgrade(): Effect.Effect<Socket.Socket, HttpServerError> {
+    return this.upgradeWith({})
+  }
+
+  upgradeWith(
+    _options: { readonly headers?: Headers.Input | undefined }
+  ): Effect.Effect<Socket.Socket, HttpServerError> {
     return Effect.fail(requestParseError(this, "Not an upgradeable ServerRequest"))
   }
 }
@@ -1034,14 +1110,74 @@ const isBodyInit = (u: unknown): u is BodyInit =>
 
 const textDecoder = new TextDecoder()
 
+class BodyTooLargeError extends Error {
+  constructor(maxBytes: number) {
+    super(`Request body exceeds ${maxBytes} bytes`)
+  }
+}
+
+const readArrayBufferLimited = async (
+  source: Request,
+  maxBytes: number,
+  signal: AbortSignal
+): Promise<ArrayBuffer> => {
+  const header = source.headers.get("content-length")
+  const contentLength = header !== null && /^\d+$/.test(header) ? Number(header) : undefined
+  if (contentLength !== undefined && contentLength > maxBytes) {
+    throw new BodyTooLargeError(maxBytes)
+  }
+  if (source.body === null) {
+    return new ArrayBuffer(0)
+  }
+  // A constructed request can understate its content-length, so bytes are
+  // counted on every runtime. Cancellation is not awaited, as the source's
+  // cleanup may never settle.
+  const limit = contentLength ?? maxBytes
+  const reader = source.body.getReader()
+  const cancel = () => {
+    reader.cancel().catch(() => {})
+  }
+  signal.addEventListener("abort", cancel, { once: true })
+  const chunks: Array<Uint8Array> = []
+  let bytes = 0
+  try {
+    while (true) {
+      const { done, value } = await reader.read()
+      if (done) break
+      bytes += value.byteLength
+      if (bytes > limit) {
+        cancel()
+        throw bytes > maxBytes
+          ? new BodyTooLargeError(maxBytes)
+          : new Error(`Request body is longer than its content-length of ${contentLength}`)
+      }
+      chunks.push(value)
+    }
+  } finally {
+    signal.removeEventListener("abort", cancel)
+    reader.releaseLock()
+  }
+  const buffer = new Uint8Array(bytes)
+  let offset = 0
+  for (const chunk of chunks) {
+    buffer.set(chunk, offset)
+    offset += chunk.byteLength
+  }
+  return buffer.buffer
+}
+
 /**
  * Attempts to construct an absolute `URL` for a server request safely.
  *
  * **Details**
  *
- * The host comes from the `host` header, defaulting to `localhost`, and the
- * protocol is `https` only when `x-forwarded-proto` is `https`; invalid URLs
- * return `Option.none`.
+ * Uses `host` (defaulting to `localhost`) and the request `protocol` set by
+ * trusted proxy middleware. Otherwise, infers HTTPS from a case-insensitive
+ * `https:` prefix in `originalUrl`, defaulting to HTTP. Forwarding headers such
+ * as `x-forwarded-proto` are never read directly; use
+ * `HttpMiddleware.xForwardedHeaders` behind a TLS-terminating proxy. An
+ * absolute `url` keeps its own protocol and host. Invalid URLs return
+ * `Option.none`.
  *
  * @stability unstable
  * @category converting
@@ -1049,9 +1185,10 @@ const textDecoder = new TextDecoder()
  */
 export const toURL = (self: HttpServerRequest): Option.Option<URL> => {
   const host = self.headers.host ?? "localhost"
-  const protocol = self.headers["x-forwarded-proto"] === "https" ? "https" : "http"
+  const protocol = self.protocol ?? (/^https:/i.test(self.originalUrl) ? "https" : "http")
   try {
-    return Option.some(new URL(self.url, `${protocol}://${host}`))
+    // Prefix paths with `.` so leading `//` cannot replace the host.
+    return Option.some(new URL(self.url.startsWith("/") ? `.${self.url}` : self.url, `${protocol}://${host}`))
   } catch {
     return Option.none()
   }
@@ -1094,7 +1231,15 @@ export const toWebResult = (self: HttpServerRequest, options?: {
     requestInit.signal = options.signal
   }
   if (hasBody(self.method)) {
-    requestInit.body = Stream.toReadableStreamWith(self.stream, options?.context ?? Context.empty())
+    // Opening on the first pull with a zero high-water mark reads the body only
+    // when the Web body is read, so converting a request leaves it readable.
+    requestInit.body = Stream.toReadableStreamWith(
+      lazyStream.openOnFirstPull(self.stream),
+      options?.context ?? Context.empty(),
+      {
+        strategy: { highWaterMark: 0 }
+      }
+    )
     ;(requestInit as any).duplex = "half"
   }
   return Result.succeed(new Request(url.value, requestInit))

package/src/http/HttpServerResponse.ts

@@ -25,6 +25,7 @@ import { hasProperty } from "../Predicate.ts"
 import { redact } from "../Redactable.ts"
 import type * as Schema from "../Schema.ts"
 import type { ParseOptions } from "../SchemaAST.ts"
+import type * as Socket from "../socket/Socket.ts"
 import * as Stream from "../Stream.ts"
 import type { Mutable } from "../Types.ts"
 import * as Cookies from "./Cookies.ts"
@@ -76,6 +77,9 @@ export interface Options {
   readonly headers?: Headers.Input | undefined
   readonly cookies?: Cookies.Cookies | undefined
   readonly contentType?: string | undefined
+  /**
+   * Sent as `content-length`, so it must equal the body's byte length.
+   */
   readonly contentLength?: number | undefined
 }
 
@@ -1346,6 +1350,9 @@ export const setStatus: {
 export const omitsBody = (response: HttpServerResponse, withoutBody = false): boolean =>
   withoutBody || response.status === 204 || response.status === 205 || response.status === 304
 
+// HEAD and 304 retain the representation length; 204 and 205 omit it.
+const omitsContentLength = (status: number): boolean => status === 204 || status === 205
+
 const mergeHeaders = (target: globalThis.Headers, headers: globalThis.Headers): globalThis.Headers => {
   for (const [key, value] of headers as any) {
     if (key === "set-cookie") {
@@ -1366,15 +1373,15 @@ const mergeHeaders = (target: globalThis.Headers, headers: globalThis.Headers):
  * the supplied context, and are interrupted when `signal` aborts.
  *
  * Bodies are omitted for statuses 204, 205, and 304, or when `withoutBody` is true
- * (for example, for HEAD responses). Omitted raw `ReadableStream` bodies are
- * cancelled without awaiting completion, and cancellation errors are ignored.
+ * (for example, for HEAD responses). Statuses 204 and 205 also omit
+ * `content-length`. Omitted raw `ReadableStream` bodies are cancelled without
+ * awaiting completion, and cancellation errors are ignored.
  *
- * A raw `Response` is returned as-is when there are no outer headers or cookies
- * to merge. Otherwise, they are merged into a copy without modifying the raw
- * response: outer headers replace native ones, and cookies are appended. When
- * its body is omitted, the bodyless `Response` keeps those merged
- * headers and uses the outer status for 204, 205 and 304, or the raw `Response`
- * status otherwise.
+ * A raw `Response` is returned as-is unless its body or `content-length` must
+ * be omitted, or outer headers or cookies must be merged. Copies leave the
+ * original unchanged: outer headers replace native ones, and cookies append.
+ * Bodyless copies use the outer status for 204, 205 and 304; otherwise they keep
+ * the raw status.
  *
  * @stability unstable
  * @category converting
@@ -1400,27 +1407,28 @@ export const toWeb = (
   const withoutBody = outerOmitsBody || options?.withoutBody === true
   if (body._tag === "Raw" && body.body instanceof Response) {
     const raw = body.body
-    if (!withoutBody) {
-      if (headers.keys().next().done) {
-        return raw
-      }
-      const copy = new Response(raw.body, raw)
-      mergeHeaders(copy.headers, headers)
-      return copy
-    }
-    // A bodyless outer status is what the caller chose to send; otherwise the
-    // body is only omitted for HEAD and the raw Response describes the resource.
+    // HEAD preserves the raw status; an explicit bodyless status overrides it.
     const source = outerOmitsBody ? response : raw
-    return new Response(undefined, {
-      status: source.status,
-      statusText: source.statusText as string,
-      headers: mergeHeaders(new globalThis.Headers(raw.headers), headers)
-    })
+    const omitContentLength = omitsContentLength(source.status)
+    if (!withoutBody && headers.keys().next().done && !(omitContentLength && raw.headers.has("content-length"))) {
+      return raw
+    }
+    const copy = withoutBody
+      ? new Response(undefined, {
+        status: source.status,
+        statusText: source.statusText as string,
+        headers: raw.headers
+      })
+      : new Response(raw.body, raw)
+    mergeHeaders(copy.headers, headers)
+    if (omitContentLength) copy.headers.delete("content-length")
+    return copy
   }
   if (withoutBody) {
     if (body._tag === "Raw" && isReadableStream(body.body)) {
       body.body.cancel().catch(constVoid)
     }
+    if (omitsContentLength(response.status)) headers.delete("content-length")
     return new Response(undefined, {
       status: response.status,
       statusText: response.statusText as string,
@@ -1696,6 +1704,18 @@ class ServerHttpClientResponse extends Inspectable.Class implements HttpClientRe
     return this.formDataResponse ??= new Response((this.response.body as Body.FormData).formData)
   }
 
+  get upgrade(): Effect.Effect<Socket.Socket, HttpClientError.HttpClientError> {
+    return Effect.fail(
+      new HttpClientError.HttpClientError({
+        reason: new HttpClientError.StatusCodeError({
+          request: this.request,
+          response: this,
+          description: "a server response has no connection to hand over"
+        })
+      })
+    )
+  }
+
   pipe() {
     return pipeArguments(this, arguments)
   }
@@ -1804,6 +1824,12 @@ const makeResponse = (options: {
  * `Set-Cookie` headers are parsed into the response cookie collection and removed
  * from the header map. A present Web body is exposed as a stream body.
  *
+ * **Gotchas**
+ *
+ * Preserves `content-length`, which must match the body. When proxying a
+ * compressed response decoded by `fetch`, remove the stale length from a copy
+ * (`new Response(response.body, response)`) before converting it.
+ *
  * @stability unstable
  * @category converting
  * @since 4.0.0

package/src/http/HttpStaticServer.ts

@@ -10,12 +10,15 @@
  * @stability unstable
  * @since 4.0.0
  */
+import * as DateTime from "../DateTime.ts"
 import * as Effect from "../Effect.ts"
 import * as FileSystem from "../FileSystem.ts"
 import * as Layer from "../Layer.ts"
 import * as Option from "../Option.ts"
 import * as Path from "../Path.ts"
 import type { PlatformError } from "../PlatformError.ts"
+import * as Result from "../Result.ts"
+import * as Headers from "./Headers.ts"
 import * as HttpPlatform from "./HttpPlatform.ts"
 import * as HttpRouter from "./HttpRouter.ts"
 import * as HttpServerError from "./HttpServerError.ts"
@@ -118,7 +121,9 @@ export const make: (options: {
   ) => Effect.Effect<HttpServerResponse.HttpServerResponse, HttpServerError.HttpServerError> = Effect.fnUntraced(
     function*(request, filePath, fileSize) {
       const rangeHeader = request.method === "GET" ? request.headers["range"] : undefined
-      const shouldEvaluateConditionals = request.headers["if-none-match"] !== undefined ||
+      const shouldEvaluateConditionals = request.headers["if-match"] !== undefined ||
+        request.headers["if-unmodified-since"] !== undefined ||
+        request.headers["if-none-match"] !== undefined ||
         request.headers["if-modified-since"] !== undefined
 
       let fullResponse: HttpServerResponse.HttpServerResponse | undefined
@@ -207,12 +212,26 @@ export const make: (options: {
           return serveFile(request, resolvedPath, info.size)
         }
         if (info.type === "Directory" && index !== undefined) {
+          let originalUrl = request.originalUrl
+          if (!originalUrl.startsWith("/")) {
+            const url = new URL(originalUrl)
+            originalUrl = url.pathname + url.search
+          }
+          const pathname = stripQueryString(originalUrl)
+          if (!pathname.endsWith("/")) {
+            // Keep the redirect local even when the path starts with multiple separators.
+            const location = pathname.replace(/^\/+/, "/").replace(/\\/g, "%5C")
+            return Effect.succeed(HttpServerResponse.redirect(
+              `${location}/${originalUrl.slice(pathname.length)}`,
+              { status: 301 }
+            ))
+          }
           return serveFile(request, path.join(resolvedPath, index))
         }
         return Effect.fail(toRouteNotFoundError(request))
       }
-    })
-  })
+    });
+  });
 })
 
 /**
@@ -429,6 +448,22 @@ const stripWeakEtagPrefix = (value: string): string => {
   return /^w\//i.test(trimmed) ? trimmed.slice(2) : trimmed;
 }
 
+// If-Match uses strong comparison (RFC 9110 §13.1.1), so weak tags never
+// match. Tags may contain commas, so the list is validated whole rather than
+// split, and a malformed list matches nothing.
+const entityTagList = /^[\s,]*(?:(?:W\/)?"[^"]*"\s*(?:,[\s,]*|$))*$/
+const entityTag = /(?:W\/)?"[^"]*"/g
+
+const matchesIfMatch = (ifMatch: string, etag: string | undefined): boolean => {
+  if (ifMatch.trim() === "*") {
+    return true
+  }
+  if (etag === undefined || !etag.startsWith("\"") || !entityTagList.test(ifMatch)) {
+    return false
+  }
+  return ifMatch.match(entityTag)?.includes(etag) ?? false
+}
+
 const matchesIfNoneMatch = (ifNoneMatch: string, etag: string | undefined): boolean => {
   const normalizedEtag = etag === undefined ? undefined : stripWeakEtagPrefix(etag)
   for (const candidate of ifNoneMatch.split(",")) {
@@ -446,19 +481,19 @@ const matchesIfNoneMatch = (ifNoneMatch: string, etag: string | undefined): bool
   return false
 }
 
-const isNotModifiedSince = (ifModifiedSince: string, lastModified: string | undefined): boolean => {
+// An invalid date on either side disables the precondition (RFC 9110 §13.1.3–4).
+const isModifiedSince = (since: string, lastModified: string | undefined): boolean | undefined => {
   if (lastModified === undefined) {
-    return false
-  }
-  const ifModifiedSinceMs = Date.parse(ifModifiedSince)
-  if (Number.isNaN(ifModifiedSinceMs)) {
-    return false
+    return undefined
   }
-  const lastModifiedMs = Date.parse(lastModified)
-  if (Number.isNaN(lastModifiedMs)) {
-    return false
+  const sinceDate = Headers.parseHttpDate(since)
+  if (Result.isFailure(sinceDate)) {
+    return undefined
   }
-  return lastModifiedMs <= ifModifiedSinceMs
+  const lastModifiedDate = Headers.parseHttpDate(lastModified)
+  return Result.isSuccess(lastModifiedDate)
+    ? DateTime.toEpochMillis(lastModifiedDate.success) > DateTime.toEpochMillis(sinceDate.success)
+    : undefined
 }
 
 // Only a strong entity-tag can match (RFC 9110 §13.1.5). Weak tags start
@@ -469,21 +504,18 @@ const matchesIfRange = (ifRange: string, etag: string | undefined): boolean => {
   return value.startsWith("\"") && value === etag
 }
 
+// Headers a 304 must repeat from the 200 response (RFC 9110 §15.4.5), plus Last-Modified for revalidation.
+const notModifiedHeaders = ["cache-control", "content-location", "date", "etag", "expires", "last-modified", "vary"]
+
 const notModifiedResponse = (
   response: HttpServerResponse.HttpServerResponse
 ): HttpServerResponse.HttpServerResponse => {
   const headers: Record<string, string> = {}
-  const etag = response.headers["etag"]
-  if (etag !== undefined) {
-    headers["ETag"] = etag
-  }
-  const cacheControl = response.headers["cache-control"]
-  if (cacheControl !== undefined) {
-    headers["Cache-Control"] = cacheControl
-  }
-  const lastModified = response.headers["last-modified"]
-  if (lastModified !== undefined) {
-    headers["Last-Modified"] = lastModified
+  for (const name of notModifiedHeaders) {
+    const value = response.headers[name]
+    if (value !== undefined) {
+      headers[name] = value
+    }
   }
   return HttpServerResponse.empty({
     status: 304,
@@ -495,12 +527,25 @@ const evaluateConditionalRequest = (
   request: HttpServerRequest.HttpServerRequest,
   response: HttpServerResponse.HttpServerResponse
 ): HttpServerResponse.HttpServerResponse | undefined => {
+  const etag = response.headers["etag"]
+  const lastModified = response.headers["last-modified"]
+  const ifMatch = request.headers["if-match"]
+  if (ifMatch !== undefined) {
+    if (!matchesIfMatch(ifMatch, etag)) {
+      return HttpServerResponse.empty({ status: 412 })
+    }
+  } else {
+    const ifUnmodifiedSince = request.headers["if-unmodified-since"]
+    if (ifUnmodifiedSince !== undefined && isModifiedSince(ifUnmodifiedSince, lastModified) === true) {
+      return HttpServerResponse.empty({ status: 412 })
+    }
+  }
   const ifNoneMatch = request.headers["if-none-match"]
   if (ifNoneMatch !== undefined) {
-    return matchesIfNoneMatch(ifNoneMatch, response.headers["etag"]) ? notModifiedResponse(response) : undefined
+    return matchesIfNoneMatch(ifNoneMatch, etag) ? notModifiedResponse(response) : undefined
   }
   const ifModifiedSince = request.headers["if-modified-since"]
-  if (ifModifiedSince !== undefined && isNotModifiedSince(ifModifiedSince, response.headers["last-modified"])) {
+  if (ifModifiedSince !== undefined && isModifiedSince(ifModifiedSince, lastModified) === false) {
     return notModifiedResponse(response)
   }
   return undefined