fastify 5.0.0 → 5.2.0

package/test/request-error.test.js

@@ -363,6 +363,128 @@ test('request.routeOptions should be immutable', t => {
   })
 })
 
+test('request.routeOptions.method is an uppercase string /1', t => {
+  t.plan(4)
+  const fastify = Fastify()
+  const handler = function (req, res) {
+    t.equal('POST', req.routeOptions.method)
+    res.send({})
+  }
+
+  fastify.post('/', {
+    bodyLimit: 1000,
+    handler
+  })
+  fastify.listen({ port: 0 }, function (err) {
+    t.error(err)
+    t.teardown(() => { fastify.close() })
+
+    sget({
+      method: 'POST',
+      url: 'http://localhost:' + fastify.server.address().port,
+      headers: { 'Content-Type': 'application/json' },
+      body: [],
+      json: true
+    }, (err, response, body) => {
+      t.error(err)
+      t.equal(response.statusCode, 200)
+    })
+  })
+})
+
+test('request.routeOptions.method is an uppercase string /2', t => {
+  t.plan(4)
+  const fastify = Fastify()
+  const handler = function (req, res) {
+    t.equal('POST', req.routeOptions.method)
+    res.send({})
+  }
+
+  fastify.route({
+    url: '/',
+    method: 'POST',
+    bodyLimit: 1000,
+    handler
+  })
+  fastify.listen({ port: 0 }, function (err) {
+    t.error(err)
+    t.teardown(() => { fastify.close() })
+
+    sget({
+      method: 'POST',
+      url: 'http://localhost:' + fastify.server.address().port,
+      headers: { 'Content-Type': 'application/json' },
+      body: [],
+      json: true
+    }, (err, response, body) => {
+      t.error(err)
+      t.equal(response.statusCode, 200)
+    })
+  })
+})
+
+test('request.routeOptions.method is an uppercase string /3', t => {
+  t.plan(4)
+  const fastify = Fastify()
+  const handler = function (req, res) {
+    t.equal('POST', req.routeOptions.method)
+    res.send({})
+  }
+
+  fastify.route({
+    url: '/',
+    method: 'pOSt',
+    bodyLimit: 1000,
+    handler
+  })
+  fastify.listen({ port: 0 }, function (err) {
+    t.error(err)
+    t.teardown(() => { fastify.close() })
+
+    sget({
+      method: 'POST',
+      url: 'http://localhost:' + fastify.server.address().port,
+      headers: { 'Content-Type': 'application/json' },
+      body: [],
+      json: true
+    }, (err, response, body) => {
+      t.error(err)
+      t.equal(response.statusCode, 200)
+    })
+  })
+})
+
+test('request.routeOptions.method is an array with uppercase string', t => {
+  t.plan(4)
+  const fastify = Fastify()
+  const handler = function (req, res) {
+    t.strictSame(['POST'], req.routeOptions.method)
+    res.send({})
+  }
+
+  fastify.route({
+    url: '/',
+    method: ['pOSt'],
+    bodyLimit: 1000,
+    handler
+  })
+  fastify.listen({ port: 0 }, function (err) {
+    t.error(err)
+    t.teardown(() => { fastify.close() })
+
+    sget({
+      method: 'POST',
+      url: 'http://localhost:' + fastify.server.address().port,
+      headers: { 'Content-Type': 'application/json' },
+      body: [],
+      json: true
+    }, (err, response, body) => {
+      t.error(err)
+      t.equal(response.statusCode, 200)
+    })
+  })
+})
+
 test('test request.routeOptions.version', t => {
   t.plan(7)
   const fastify = Fastify()

package/test/request-header-host.test.js

@@ -0,0 +1,339 @@
+'use strict'
+
+const { test } = require('node:test')
+const { connect } = require('node:net')
+const Fastify = require('..')
+
+// RFC9112
+// https://www.rfc-editor.org/rfc/rfc9112
+test('Return 400 when Host header is missing', (t, done) => {
+  t.plan(2)
+  let data = Buffer.alloc(0)
+  const fastify = Fastify()
+
+  t.after(() => fastify.close())
+
+  fastify.get('/', async function () {
+    t.assert.fail('should not reach handler')
+    return { ok: true }
+  })
+  fastify.listen({ port: 0 }, err => {
+    t.assert.ifError(err)
+
+    const socket = connect(fastify.server.address().port)
+    socket.write('GET / HTTP/1.1\r\n\r\n')
+    socket.on('data', c => (data = Buffer.concat([data, c])))
+    socket.on('end', () => {
+      t.assert.match(
+        data.toString('utf-8'),
+        /^HTTP\/1.1 400 Bad Request/
+      )
+      done()
+    })
+  })
+})
+
+test('Return 400 when Host header is missing with trust proxy', (t, done) => {
+  t.plan(2)
+  let data = Buffer.alloc(0)
+  const fastify = Fastify({
+    trustProxy: true
+  })
+
+  t.after(() => fastify.close())
+
+  fastify.get('/', async function () {
+    t.assert.fail('should not reach handler')
+    return { ok: true }
+  })
+  fastify.listen({ port: 0 }, err => {
+    t.assert.ifError(err)
+
+    const socket = connect(fastify.server.address().port)
+    socket.write('GET / HTTP/1.1\r\n\r\n')
+    socket.on('data', c => (data = Buffer.concat([data, c])))
+    socket.on('end', () => {
+      t.assert.match(
+        data.toString('utf-8'),
+        /^HTTP\/1.1 400 Bad Request/
+      )
+      done()
+    })
+  })
+})
+
+test('Return 200 when Host header is empty', (t, done) => {
+  t.plan(5)
+  let data = Buffer.alloc(0)
+  const fastify = Fastify({
+    keepAliveTimeout: 10
+  })
+
+  t.after(() => fastify.close())
+
+  fastify.get('/', async function (request) {
+    t.assert.strictEqual(request.host, '')
+    t.assert.strictEqual(request.hostname, '')
+    t.assert.strictEqual(request.port, null)
+    return { ok: true }
+  })
+  fastify.listen({ port: 0 }, err => {
+    t.assert.ifError(err)
+
+    const socket = connect(fastify.server.address().port)
+    socket.write('GET / HTTP/1.1\r\nHost:\r\n\r\n')
+    socket.on('data', c => (data = Buffer.concat([data, c])))
+    socket.on('end', () => {
+      t.assert.match(
+        data.toString('utf-8'),
+        /^HTTP\/1.1 200 OK/
+      )
+      done()
+    })
+  })
+})
+
+test('Return 200 when Host header is empty with trust proxy', (t, done) => {
+  t.plan(5)
+  let data = Buffer.alloc(0)
+  const fastify = Fastify({
+    trustProxy: true,
+    keepAliveTimeout: 10
+  })
+
+  t.after(() => fastify.close())
+
+  fastify.get('/', async function (request) {
+    t.assert.strictEqual(request.host, '')
+    t.assert.strictEqual(request.hostname, '')
+    t.assert.strictEqual(request.port, null)
+    return { ok: true }
+  })
+  fastify.listen({ port: 0 }, err => {
+    t.assert.ifError(err)
+
+    const socket = connect(fastify.server.address().port)
+    socket.write('GET / HTTP/1.1\r\nHost:\r\n\r\n')
+    socket.on('data', c => (data = Buffer.concat([data, c])))
+    socket.on('end', () => {
+      t.assert.match(
+        data.toString('utf-8'),
+        /^HTTP\/1.1 200 OK/
+      )
+      done()
+    })
+  })
+})
+
+// Node.js allows exploiting RFC9112
+// https://nodejs.org/docs/latest-v22.x/api/http.html#httpcreateserveroptions-requestlistener
+test('Return 200 when Host header is missing and http.requireHostHeader = false', (t, done) => {
+  t.plan(5)
+  let data = Buffer.alloc(0)
+  const fastify = Fastify({
+    http: {
+      requireHostHeader: false
+    },
+    keepAliveTimeout: 10
+  })
+
+  t.after(() => fastify.close())
+
+  fastify.get('/', async function (request) {
+    t.assert.strictEqual(request.host, '')
+    t.assert.strictEqual(request.hostname, '')
+    t.assert.strictEqual(request.port, null)
+    return { ok: true }
+  })
+  fastify.listen({ port: 0 }, err => {
+    t.assert.ifError(err)
+
+    const socket = connect(fastify.server.address().port)
+    socket.write('GET / HTTP/1.1\r\n\r\n')
+    socket.on('data', c => (data = Buffer.concat([data, c])))
+    socket.on('end', () => {
+      t.assert.match(
+        data.toString('utf-8'),
+        /^HTTP\/1.1 200 OK/
+      )
+      done()
+    })
+  })
+})
+
+test('Return 200 when Host header is missing and http.requireHostHeader = false with trust proxy', (t, done) => {
+  t.plan(5)
+  let data = Buffer.alloc(0)
+  const fastify = Fastify({
+    http: {
+      requireHostHeader: false
+    },
+    trustProxy: true,
+    keepAliveTimeout: 10
+  })
+
+  t.after(() => fastify.close())
+
+  fastify.get('/', async function (request) {
+    t.assert.strictEqual(request.host, '')
+    t.assert.strictEqual(request.hostname, '')
+    t.assert.strictEqual(request.port, null)
+    return { ok: true }
+  })
+  fastify.listen({ port: 0 }, err => {
+    t.assert.ifError(err)
+
+    const socket = connect(fastify.server.address().port)
+    socket.write('GET / HTTP/1.1\r\n\r\n')
+    socket.on('data', c => (data = Buffer.concat([data, c])))
+    socket.on('end', () => {
+      t.assert.match(
+        data.toString('utf-8'),
+        /^HTTP\/1.1 200 OK/
+      )
+      done()
+    })
+  })
+})
+
+test('Return 200 when Host header is missing using HTTP/1.0', (t, done) => {
+  t.plan(5)
+  let data = Buffer.alloc(0)
+  const fastify = Fastify({
+    keepAliveTimeout: 10
+  })
+
+  t.after(() => fastify.close())
+
+  fastify.get('/', async function (request) {
+    t.assert.strictEqual(request.host, '')
+    t.assert.strictEqual(request.hostname, '')
+    t.assert.strictEqual(request.port, null)
+    return { ok: true }
+  })
+  fastify.listen({ port: 0 }, err => {
+    t.assert.ifError(err)
+
+    const socket = connect(fastify.server.address().port)
+    socket.write('GET / HTTP/1.0\r\n\r\n')
+    socket.on('data', c => (data = Buffer.concat([data, c])))
+    socket.on('end', () => {
+      t.assert.match(
+        data.toString('utf-8'),
+        /^HTTP\/1.1 200 OK/
+      )
+      done()
+    })
+  })
+})
+
+test('Return 200 when Host header is missing with trust proxy using HTTP/1.0', (t, done) => {
+  t.plan(5)
+  let data = Buffer.alloc(0)
+  const fastify = Fastify({
+    trustProxy: true,
+    keepAliveTimeout: 10
+  })
+
+  t.after(() => fastify.close())
+
+  fastify.get('/', async function (request) {
+    t.assert.strictEqual(request.host, '')
+    t.assert.strictEqual(request.hostname, '')
+    t.assert.strictEqual(request.port, null)
+    return { ok: true }
+  })
+  fastify.listen({ port: 0 }, err => {
+    t.assert.ifError(err)
+
+    const socket = connect(fastify.server.address().port)
+    socket.write('GET / HTTP/1.0\r\n\r\n')
+    socket.on('data', c => (data = Buffer.concat([data, c])))
+    socket.on('end', () => {
+      t.assert.match(
+        data.toString('utf-8'),
+        /^HTTP\/1.1 200 OK/
+      )
+      done()
+    })
+  })
+})
+
+test('Return 200 when Host header is removed by schema', (t, done) => {
+  t.plan(5)
+  let data = Buffer.alloc(0)
+  const fastify = Fastify({
+    keepAliveTimeout: 10
+  })
+
+  t.after(() => fastify.close())
+
+  fastify.get('/', {
+    schema: {
+      headers: {
+        type: 'object',
+        properties: {},
+        additionalProperties: false
+      }
+    }
+  }, async function (request) {
+    t.assert.strictEqual(request.host, '')
+    t.assert.strictEqual(request.hostname, '')
+    t.assert.strictEqual(request.port, null)
+    return { ok: true }
+  })
+  fastify.listen({ port: 0 }, err => {
+    t.assert.ifError(err)
+
+    const socket = connect(fastify.server.address().port)
+    socket.write('GET / HTTP/1.1\r\nHost: localhost\r\n\r\n')
+    socket.on('data', c => (data = Buffer.concat([data, c])))
+    socket.on('end', () => {
+      t.assert.match(
+        data.toString('utf-8'),
+        /^HTTP\/1.1 200 OK/
+      )
+      done()
+    })
+  })
+})
+
+test('Return 200 when Host header is removed by schema with trust proxy', (t, done) => {
+  t.plan(5)
+  let data = Buffer.alloc(0)
+  const fastify = Fastify({
+    trustProxy: true,
+    keepAliveTimeout: 10
+  })
+
+  t.after(() => fastify.close())
+
+  fastify.get('/', {
+    schema: {
+      headers: {
+        type: 'object',
+        properties: {},
+        additionalProperties: false
+      }
+    }
+  }, async function (request) {
+    t.assert.strictEqual(request.host, '')
+    t.assert.strictEqual(request.hostname, '')
+    t.assert.strictEqual(request.port, null)
+    return { ok: true }
+  })
+  fastify.listen({ port: 0 }, err => {
+    t.assert.ifError(err)
+
+    const socket = connect(fastify.server.address().port)
+    socket.write('GET / HTTP/1.1\r\nHost: localhost\r\n\r\n')
+    socket.on('data', c => (data = Buffer.concat([data, c])))
+    socket.on('end', () => {
+      t.assert.match(
+        data.toString('utf-8'),
+        /^HTTP\/1.1 200 OK/
+      )
+      done()
+    })
+  })
+})

package/test/request-id.test.js

@@ -1,10 +1,10 @@
 'use strict'
 
-const t = require('tap')
+const { test } = require('node:test')
 const Fastify = require('..')
 const sget = require('simple-get').concat
 
-t.test('The request id header key can be customized', async (t) => {
+test('The request id header key can be customized', async (t) => {
   t.plan(2)
   const REQUEST_ID = '42'
 
@@ -13,16 +13,16 @@ t.test('The request id header key can be customized', async (t) => {
   })
 
   fastify.get('/', (req, reply) => {
-    t.equal(req.id, REQUEST_ID)
+    t.assert.strictEqual(req.id, REQUEST_ID)
     reply.send({ id: req.id })
   })
 
   const response = await fastify.inject({ method: 'GET', url: '/', headers: { 'my-custom-request-id': REQUEST_ID } })
   const body = await response.json()
-  t.equal(body.id, REQUEST_ID)
+  t.assert.strictEqual(body.id, REQUEST_ID)
 })
 
-t.test('The request id header key can be customized', async (t) => {
+test('The request id header key can be customized', async (t) => {
   t.plan(2)
   const REQUEST_ID = '42'
 
@@ -31,16 +31,16 @@ t.test('The request id header key can be customized', async (t) => {
   })
 
   fastify.get('/', (req, reply) => {
-    t.equal(req.id, REQUEST_ID)
+    t.assert.strictEqual(req.id, REQUEST_ID)
     reply.send({ id: req.id })
   })
 
   const response = await fastify.inject({ method: 'GET', url: '/', headers: { 'MY-CUSTOM-REQUEST-ID': REQUEST_ID } })
   const body = await response.json()
-  t.equal(body.id, REQUEST_ID)
+  t.assert.strictEqual(body.id, REQUEST_ID)
 })
 
-t.test('The request id header key can be customized', (t) => {
+test('The request id header key can be customized', (t, done) => {
   t.plan(4)
   const REQUEST_ID = '42'
 
@@ -49,13 +49,14 @@ t.test('The request id header key can be customized', (t) => {
   })
 
   fastify.get('/', (req, reply) => {
-    t.equal(req.id, REQUEST_ID)
+    t.assert.strictEqual(req.id, REQUEST_ID)
     reply.send({ id: req.id })
   })
 
+  t.after(() => fastify.close())
+
   fastify.listen({ port: 0 }, (err, address) => {
-    t.error(err)
-    t.teardown(() => fastify.close())
+    t.assert.ifError(err)
 
     sget({
       method: 'GET',
@@ -64,13 +65,14 @@ t.test('The request id header key can be customized', (t) => {
         'my-custom-request-id': REQUEST_ID
       }
     }, (err, response, body) => {
-      t.error(err)
-      t.equal(body.toString(), `{"id":"${REQUEST_ID}"}`)
+      t.assert.ifError(err)
+      t.assert.strictEqual(body.toString(), `{"id":"${REQUEST_ID}"}`)
+      done()
     })
   })
 })
 
-t.test('The request id header key can be customized', (t) => {
+test('The request id header key can be customized', (t, done) => {
   t.plan(4)
   const REQUEST_ID = '42'
 
@@ -79,13 +81,14 @@ t.test('The request id header key can be customized', (t) => {
   })
 
   fastify.get('/', (req, reply) => {
-    t.equal(req.id, REQUEST_ID)
+    t.assert.strictEqual(req.id, REQUEST_ID)
     reply.send({ id: req.id })
   })
 
+  t.after(() => fastify.close())
+
   fastify.listen({ port: 0 }, (err, address) => {
-    t.error(err)
-    t.teardown(() => fastify.close())
+    t.assert.ifError(err)
 
     sget({
       method: 'GET',
@@ -94,13 +97,14 @@ t.test('The request id header key can be customized', (t) => {
         'MY-CUSTOM-REQUEST-ID': REQUEST_ID
       }
     }, (err, response, body) => {
-      t.error(err)
-      t.equal(body.toString(), `{"id":"${REQUEST_ID}"}`)
+      t.assert.ifError(err)
+      t.assert.strictEqual(body.toString(), `{"id":"${REQUEST_ID}"}`)
+      done()
     })
   })
 })
 
-t.test('The request id header key can be customized', (t) => {
+test('The request id header key can be customized', (t, done) => {
   t.plan(4)
   const REQUEST_ID = '42'
 
@@ -109,13 +113,14 @@ t.test('The request id header key can be customized', (t) => {
   })
 
   fastify.get('/', (req, reply) => {
-    t.equal(req.id, REQUEST_ID)
+    t.assert.strictEqual(req.id, REQUEST_ID)
     reply.send({ id: req.id })
   })
 
+  t.after(() => fastify.close())
+
   fastify.listen({ port: 0 }, (err, address) => {
-    t.error(err)
-    t.teardown(() => fastify.close())
+    t.assert.ifError(err)
 
     sget({
       method: 'GET',
@@ -124,8 +129,9 @@ t.test('The request id header key can be customized', (t) => {
         'MY-CUSTOM-REQUEST-ID': REQUEST_ID
       }
     }, (err, response, body) => {
-      t.error(err)
-      t.equal(body.toString(), `{"id":"${REQUEST_ID}"}`)
+      t.assert.ifError(err)
+      t.assert.strictEqual(body.toString(), `{"id":"${REQUEST_ID}"}`)
+      done()
     })
   })
 })

package/test/{requestTimeout.test.js → request-timeout.test.js}

@@ -1,31 +1,31 @@
 'use strict'
 
 const http = require('node:http')
-const { test } = require('tap')
-const Fastify = require('../fastify')
+const { test } = require('node:test')
+const Fastify = require('..')
 
 test('requestTimeout passed to server', t => {
   t.plan(5)
 
   try {
     Fastify({ requestTimeout: 500.1 })
-    t.fail('option must be an integer')
+    t.assert.fail('option must be an integer')
   } catch (err) {
-    t.ok(err)
+    t.assert.ok(err)
   }
 
   try {
     Fastify({ requestTimeout: [] })
-    t.fail('option must be an integer')
+    t.assert.fail('option must be an integer')
   } catch (err) {
-    t.ok(err)
+    t.assert.ok(err)
   }
 
   const httpServer = Fastify({ requestTimeout: 1000 }).server
-  t.equal(httpServer.requestTimeout, 1000)
+  t.assert.strictEqual(httpServer.requestTimeout, 1000)
 
   const httpsServer = Fastify({ requestTimeout: 1000, https: true }).server
-  t.equal(httpsServer.requestTimeout, 1000)
+  t.assert.strictEqual(httpsServer.requestTimeout, 1000)
 
   const serverFactory = (handler, _) => {
     const server = http.createServer((req, res) => {
@@ -35,19 +35,19 @@ test('requestTimeout passed to server', t => {
     return server
   }
   const customServer = Fastify({ requestTimeout: 4000, serverFactory }).server
-  t.equal(customServer.requestTimeout, 5000)
+  t.assert.strictEqual(customServer.requestTimeout, 5000)
 })
 
 test('requestTimeout should be set', async (t) => {
   t.plan(1)
 
   const initialConfig = Fastify({ requestTimeout: 5000 }).initialConfig
-  t.same(initialConfig.requestTimeout, 5000)
+  t.assert.strictEqual(initialConfig.requestTimeout, 5000)
 })
 
 test('requestTimeout should 0', async (t) => {
   t.plan(1)
 
   const initialConfig = Fastify().initialConfig
-  t.same(initialConfig.requestTimeout, 0)
+  t.assert.strictEqual(initialConfig.requestTimeout, 0)
 })