http-proxy-middleware 3.0.4 → 4.0.0-beta.0

package/README.md

@@ -28,10 +28,8 @@ Proxy `/api` requests to `http://www.example.org`
 
 ```typescript
 // typescript
-
 import * as express from 'express';
-import type { Request, Response, NextFunction } from 'express';
-
+import type { NextFunction, Request, Response } from 'express';
 import { createProxyMiddleware } from 'http-proxy-middleware';
 import type { Filter, Options, RequestHandler } from 'http-proxy-middleware';
 
@@ -163,18 +161,15 @@ http-proxy-middleware options:
 Narrow down which requests should be proxied. The `path` used for filtering is the `request.url` pathname. In Express, this is the `path` relative to the mount-point of the proxy.
 
 - **path matching**
-
   - `createProxyMiddleware({...})` - matches any path, all requests will be proxied when `pathFilter` is not configured.
   - `createProxyMiddleware({ pathFilter: '/api', ...})` - matches paths starting with `/api`
 
 - **multiple path matching**
-
   - `createProxyMiddleware({ pathFilter: ['/api', '/ajax', '/someotherpath'], ...})`
 
 - **wildcard path matching**
 
   For fine-grained control you can use wildcard matching. Glob pattern matching is done by _micromatch_. Visit [micromatch](https://www.npmjs.com/package/micromatch) or [glob](https://www.npmjs.com/package/glob) for more globbing examples.
-
   - `createProxyMiddleware({ pathFilter: '**', ...})` matches any path, all requests will be proxied.
   - `createProxyMiddleware({ pathFilter: '**/*.html', ...})` matches any path which ends with `.html`
   - `createProxyMiddleware({ pathFilter: '/*.html', ...})` matches paths directly under path-absolute
@@ -418,13 +413,12 @@ The following options are provided by the underlying [http-proxy](https://github
 - **option.autoRewrite**: rewrites the location host/port on (301/302/307/308) redirects based on requested host/port. Default: false.
 - **option.protocolRewrite**: rewrites the location protocol on (301/302/307/308) redirects to 'http' or 'https'. Default: null.
 - **option.cookieDomainRewrite**: rewrites domain of `set-cookie` headers. Possible values:
-
   - `false` (default): disable cookie rewriting
   - String: new domain, for example `cookieDomainRewrite: "new.domain"`. To remove the domain, use `cookieDomainRewrite: ""`.
   - Object: mapping of domains to new domains, use `"*"` to match all domains.  
     For example keep one domain unchanged, rewrite one domain and remove other domains:
 
-    ```json
+    ```jsonc
     cookieDomainRewrite: {
       "unchanged.domain": "unchanged.domain",
       "old.domain": "new.domain",
@@ -433,13 +427,12 @@ The following options are provided by the underlying [http-proxy](https://github
     ```
 
 - **option.cookiePathRewrite**: rewrites path of `set-cookie` headers. Possible values:
-
   - `false` (default): disable cookie rewriting
   - String: new path, for example `cookiePathRewrite: "/newPath/"`. To remove the path, use `cookiePathRewrite: ""`. To set path to root use `cookiePathRewrite: "/"`.
   - Object: mapping of paths to new paths, use `"*"` to match all paths.
     For example, to keep one path unchanged, rewrite one path and remove other paths:
 
-    ```json
+    ```jsonc
     cookiePathRewrite: {
       "/unchanged.path/": "/unchanged.path/",
       "/old.path/": "/new.path/",

package/dist/factory.d.ts

@@ -1,3 +1,3 @@
-import type { Options, RequestHandler, NextFunction } from './types';
-import type * as http from 'http';
+import type * as http from 'node:http';
+import type { NextFunction, Options, RequestHandler } from './types';
 export declare function createProxyMiddleware<TReq = http.IncomingMessage, TRes = http.ServerResponse, TNext = NextFunction>(options: Options<TReq, TRes>): RequestHandler<TReq, TRes, TNext>;

package/dist/handlers/fix-request-body.d.ts

@@ -1,9 +1,8 @@
-import type * as http from 'http';
-import type { Options } from '../types';
+import type * as http from 'node:http';
 export type BodyParserLikeRequest = http.IncomingMessage & {
     body?: any;
 };
 /**
  * Fix proxied body if bodyParser is involved.
  */
-export declare function fixRequestBody<TReq extends BodyParserLikeRequest = BodyParserLikeRequest>(proxyReq: http.ClientRequest, req: TReq, res: http.ServerResponse<http.IncomingMessage>, options: Options): void;
+export declare function fixRequestBody<TReq extends BodyParserLikeRequest = BodyParserLikeRequest>(proxyReq: http.ClientRequest, req: TReq): void;

package/dist/handlers/fix-request-body.js

@@ -1,12 +1,15 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.fixRequestBody = fixRequestBody;
-const querystring = require("querystring");
-const logger_1 = require("../logger");
+const querystring = require("node:querystring");
 /**
  * Fix proxied body if bodyParser is involved.
  */
-function fixRequestBody(proxyReq, req, res, options) {
+function fixRequestBody(proxyReq, req) {
+    // skip fixRequestBody() when req.readableLength not 0 (bodyParser failure)
+    if (req.readableLength !== 0) {
+        return;
+    }
     const requestBody = req.body;
     if (!requestBody) {
         return;
@@ -15,19 +18,6 @@ function fixRequestBody(proxyReq, req, res, options) {
     if (!contentType) {
         return;
     }
-    const logger = (0, logger_1.getLogger)(options);
-    // Handle bad request when unexpected "Connect: Upgrade" header is provided
-    if (/upgrade/gi.test(proxyReq.getHeader('Connection'))) {
-        handleBadRequest({ proxyReq, req, res });
-        logger.error(`[HPM] HPM_UNEXPECTED_CONNECTION_UPGRADE_HEADER. Aborted request: ${req.url}`);
-        return;
-    }
-    // Handle bad request when invalid request body is provided
-    if (hasInvalidKeys(requestBody)) {
-        handleBadRequest({ proxyReq, req, res });
-        logger.error(`[HPM] HPM_INVALID_REQUEST_DATA. Aborted request: ${req.url}`);
-        return;
-    }
     const writeBody = (bodyData) => {
         proxyReq.setHeader('Content-Length', Buffer.byteLength(bodyData));
         proxyReq.write(bodyData);
@@ -43,6 +33,9 @@ function fixRequestBody(proxyReq, req, res, options) {
     else if (contentType.includes('multipart/form-data')) {
         writeBody(handlerFormDataBodyData(contentType, requestBody));
     }
+    else if (contentType.includes('text/plain')) {
+        writeBody(requestBody);
+    }
 }
 /**
  * format FormData data
@@ -58,12 +51,3 @@ function handlerFormDataBodyData(contentType, data) {
     }
     return str;
 }
-function hasInvalidKeys(obj) {
-    return Object.keys(obj).some((key) => /[\n\r]/.test(key));
-}
-function handleBadRequest({ proxyReq, req, res }) {
-    res.writeHead(400);
-    res.end('Bad Request');
-    proxyReq.destroy();
-    req.destroy();
-}

package/dist/handlers/response-interceptor.d.ts

@@ -1,5 +1,5 @@
-import type * as http from 'http';
-type Interceptor<TReq = http.IncomingMessage, TRes = http.ServerResponse> = (buffer: Buffer, proxyRes: TReq, req: TReq, res: TRes) => Promise<Buffer | string>;
+import type * as http from 'node:http';
+type Interceptor<TReq = http.IncomingMessage, TRes = http.ServerResponse> = (buffer: Buffer, proxyRes: http.IncomingMessage, req: TReq, res: TRes) => Promise<Buffer | string>;
 /**
  * Intercept responses from upstream.
  * Automatically decompress (deflate, gzip, brotli).
@@ -7,5 +7,5 @@ type Interceptor<TReq = http.IncomingMessage, TRes = http.ServerResponse> = (buf
  *
  * NOTE: must set options.selfHandleResponse=true (prevent automatic call of res.end())
  */
-export declare function responseInterceptor<TReq extends http.IncomingMessage = http.IncomingMessage, TRes extends http.ServerResponse = http.ServerResponse>(interceptor: Interceptor<TReq, TRes>): (proxyRes: TReq, req: TReq, res: TRes) => Promise<void>;
+export declare function responseInterceptor<TReq extends http.IncomingMessage = http.IncomingMessage, TRes extends http.ServerResponse = http.ServerResponse>(interceptor: Interceptor<TReq, TRes>): (proxyRes: http.IncomingMessage, req: TReq, res: TRes) => Promise<void>;
 export {};

package/dist/handlers/response-interceptor.js

@@ -1,7 +1,7 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.responseInterceptor = responseInterceptor;
-const zlib = require("zlib");
+const zlib = require("node:zlib");
 const debug_1 = require("../debug");
 const function_1 = require("../utils/function");
 const debug = debug_1.Debug.extend('response-interceptor');

package/dist/http-proxy-middleware.d.ts

@@ -1,4 +1,4 @@
-import type { RequestHandler, Options } from './types';
+import type { Options, RequestHandler } from './types';
 export declare class HttpProxyMiddleware<TReq, TRes> {
     private wsInternalSubscribed;
     private serverOnCloseSubscribed;

package/dist/http-proxy-middleware.js

@@ -1,145 +1,28 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.HttpProxyMiddleware = void 0;
-const httpProxy = require("http-proxy");
+const httpxy_1 = require("httpxy");
 const configuration_1 = require("./configuration");
+const debug_1 = require("./debug");
 const get_plugins_1 = require("./get-plugins");
+const logger_1 = require("./logger");
 const path_filter_1 = require("./path-filter");
 const PathRewriter = require("./path-rewriter");
 const Router = require("./router");
-const debug_1 = require("./debug");
 const function_1 = require("./utils/function");
-const logger_1 = require("./logger");
 class HttpProxyMiddleware {
+    wsInternalSubscribed = false;
+    serverOnCloseSubscribed = false;
+    proxyOptions;
+    proxy;
+    pathRewriter;
+    logger;
     constructor(options) {
-        this.wsInternalSubscribed = false;
-        this.serverOnCloseSubscribed = false;
-        // https://github.com/Microsoft/TypeScript/wiki/'this'-in-TypeScript#red-flags-for-this
-        this.middleware = (async (req, res, next) => {
-            if (this.shouldProxy(this.proxyOptions.pathFilter, req)) {
-                try {
-                    const activeProxyOptions = await this.prepareProxyRequest(req);
-                    (0, debug_1.Debug)(`proxy request to target: %O`, activeProxyOptions.target);
-                    this.proxy.web(req, res, activeProxyOptions);
-                }
-                catch (err) {
-                    next?.(err);
-                }
-            }
-            else {
-                next?.();
-            }
-            /**
-             * Get the server object to subscribe to server events;
-             * 'upgrade' for websocket and 'close' for graceful shutdown
-             *
-             * NOTE:
-             * req.socket: node >= 13
-             * req.connection: node < 13 (Remove this when node 12/13 support is dropped)
-             */
-            const server = (req.socket ?? req.connection)?.server;
-            if (server && !this.serverOnCloseSubscribed) {
-                server.on('close', () => {
-                    (0, debug_1.Debug)('server close signal received: closing proxy server');
-                    this.proxy.close();
-                });
-                this.serverOnCloseSubscribed = true;
-            }
-            if (this.proxyOptions.ws === true) {
-                // use initial request to access the server object to subscribe to http upgrade event
-                this.catchUpgradeRequest(server);
-            }
-        });
-        this.catchUpgradeRequest = (server) => {
-            if (!this.wsInternalSubscribed) {
-                (0, debug_1.Debug)('subscribing to server upgrade event');
-                server.on('upgrade', this.handleUpgrade);
-                // prevent duplicate upgrade handling;
-                // in case external upgrade is also configured
-                this.wsInternalSubscribed = true;
-            }
-        };
-        this.handleUpgrade = async (req, socket, head) => {
-            try {
-                if (this.shouldProxy(this.proxyOptions.pathFilter, req)) {
-                    const activeProxyOptions = await this.prepareProxyRequest(req);
-                    this.proxy.ws(req, socket, head, activeProxyOptions);
-                    (0, debug_1.Debug)('server upgrade event received. Proxying WebSocket');
-                }
-            }
-            catch (err) {
-                // This error does not include the URL as the fourth argument as we won't
-                // have the URL if `this.prepareProxyRequest` throws an error.
-                this.proxy.emit('error', err, req, socket);
-            }
-        };
-        /**
-         * Determine whether request should be proxied.
-         */
-        this.shouldProxy = (pathFilter, req) => {
-            try {
-                return (0, path_filter_1.matchPathFilter)(pathFilter, req.url, req);
-            }
-            catch (err) {
-                (0, debug_1.Debug)('Error: matchPathFilter() called with request url: ', `"${req.url}"`);
-                this.logger.error(err);
-                return false;
-            }
-        };
-        /**
-         * Apply option.router and option.pathRewrite
-         * Order matters:
-         *    Router uses original path for routing;
-         *    NOT the modified path, after it has been rewritten by pathRewrite
-         * @param {Object} req
-         * @return {Object} proxy options
-         */
-        this.prepareProxyRequest = async (req) => {
-            /**
-             * Incorrect usage confirmed: https://github.com/expressjs/express/issues/4854#issuecomment-1066171160
-             * Temporary restore req.url patch for {@link src/legacy/create-proxy-middleware.ts legacyCreateProxyMiddleware()}
-             * FIXME: remove this patch in future release
-             */
-            if (this.middleware.__LEGACY_HTTP_PROXY_MIDDLEWARE__) {
-                req.url = req.originalUrl || req.url;
-            }
-            const newProxyOptions = Object.assign({}, this.proxyOptions);
-            // Apply in order:
-            // 1. option.router
-            // 2. option.pathRewrite
-            await this.applyRouter(req, newProxyOptions);
-            await this.applyPathRewrite(req, this.pathRewriter);
-            return newProxyOptions;
-        };
-        // Modify option.target when router present.
-        this.applyRouter = async (req, options) => {
-            let newTarget;
-            if (options.router) {
-                newTarget = await Router.getTarget(req, options);
-                if (newTarget) {
-                    (0, debug_1.Debug)('router new target: "%s"', newTarget);
-                    options.target = newTarget;
-                }
-            }
-        };
-        // rewrite path
-        this.applyPathRewrite = async (req, pathRewriter) => {
-            if (pathRewriter) {
-                const path = await pathRewriter(req.url, req);
-                if (typeof path === 'string') {
-                    (0, debug_1.Debug)('pathRewrite new path: %s', req.url);
-                    req.url = path;
-                }
-                else {
-                    (0, debug_1.Debug)('pathRewrite: no rewritten path found: %s', req.url);
-                }
-            }
-        };
         (0, configuration_1.verifyConfig)(options);
         this.proxyOptions = options;
         this.logger = (0, logger_1.getLogger)(options);
         (0, debug_1.Debug)(`create proxy server`);
-        this.proxy = httpProxy.createProxyServer({});
+        this.proxy = (0, httpxy_1.createProxyServer)({});
         this.registerPlugins(this.proxy, this.proxyOptions);
         this.pathRewriter = PathRewriter.createPathRewriter(this.proxyOptions.pathRewrite); // returns undefined when "pathRewrite" is not provided
         // https://github.com/chimurai/http-proxy-middleware/issues/19
@@ -150,6 +33,67 @@ class HttpProxyMiddleware {
             }
         };
     }
+    // https://github.com/Microsoft/TypeScript/wiki/'this'-in-TypeScript#red-flags-for-this
+    middleware = (async (req, res, next) => {
+        if (this.shouldProxy(this.proxyOptions.pathFilter, req)) {
+            let activeProxyOptions;
+            try {
+                // Preparation Phase: Apply router and path rewriter.
+                activeProxyOptions = await this.prepareProxyRequest(req);
+                // [Smoking Gun] httpxy is inconsistent with error handling:
+                // 1. If target is missing (here), it emits 'error' but returns a boolean (bypassing our catch/next).
+                // 2. If a network error occurs (in proxy.web), it rejects the promise but SKIPS emitting 'error'.
+                // We manually throw here to force Case 1 into the catch block so next(err) is called for Express.
+                if (!activeProxyOptions.target && !activeProxyOptions.forward) {
+                    throw new Error('Must provide a proper URL as target');
+                }
+            }
+            catch (err) {
+                next?.(err);
+                return;
+            }
+            try {
+                // Proxying Phase: Handle the actual web request.
+                (0, debug_1.Debug)(`proxy request to target: %O`, activeProxyOptions.target);
+                await this.proxy.web(req, res, activeProxyOptions);
+            }
+            catch (err) {
+                // Manually emit 'error' event because httpxy's promise-based API does not emit it automatically.
+                // This is crucial for backward compatibility with HPM plugins (like error-response-plugin)
+                // and custom listeners registered via the 'on: { error: ... }' option.
+                /**
+                 * TODO: Ideally, TReq and TRes should be restricted via "TReq extends http.IncomingMessage = http.IncomingMessage"
+                 * and "TRes extends http.ServerResponse = http.ServerResponse", which allows us to avoid the "req as TReq" below.
+                 *
+                 * However, making TReq and TRes constrained types may cause a breaking change for TypeScript users downstream.
+                 * So we leave this as a TODO for now, and revisit it in a future major release.
+                 */
+                this.proxy.emit('error', err, req, res, activeProxyOptions.target);
+                next?.(err);
+            }
+        }
+        else {
+            next?.();
+        }
+        /**
+         * Get the server object to subscribe to server events;
+         * 'upgrade' for websocket and 'close' for graceful shutdown
+         */
+        const server = req.socket?.server;
+        if (server && !this.serverOnCloseSubscribed) {
+            server.on('close', () => {
+                (0, debug_1.Debug)('server close signal received: closing proxy server');
+                this.proxy.close(() => {
+                    (0, debug_1.Debug)('proxy server closed');
+                });
+            });
+            this.serverOnCloseSubscribed = true;
+        }
+        if (this.proxyOptions.ws === true) {
+            // use initial request to access the server object to subscribe to http upgrade event
+            this.catchUpgradeRequest(server);
+        }
+    });
     registerPlugins(proxy, options) {
         const plugins = (0, get_plugins_1.getPlugins)(options);
         plugins.forEach((plugin) => {
@@ -157,5 +101,97 @@ class HttpProxyMiddleware {
             plugin(proxy, options);
         });
     }
+    catchUpgradeRequest = (server) => {
+        if (!this.wsInternalSubscribed) {
+            (0, debug_1.Debug)('subscribing to server upgrade event');
+            server.on('upgrade', this.handleUpgrade);
+            // prevent duplicate upgrade handling;
+            // in case external upgrade is also configured
+            this.wsInternalSubscribed = true;
+        }
+    };
+    handleUpgrade = async (req, socket, head) => {
+        try {
+            if (this.shouldProxy(this.proxyOptions.pathFilter, req)) {
+                const activeProxyOptions = await this.prepareProxyRequest(req);
+                await this.proxy.ws(req, socket, activeProxyOptions, head);
+                (0, debug_1.Debug)('server upgrade event received. Proxying WebSocket');
+            }
+        }
+        catch (err) {
+            // This error does not include the URL as the fourth argument as we won't
+            // have the URL if `this.prepareProxyRequest` throws an error.
+            /**
+             * TODO: Ideally, TReq and TRes should be restricted via "TReq extends http.IncomingMessage = http.IncomingMessage"
+             * and "TRes extends http.ServerResponse = http.ServerResponse", which allows us to avoid the "req as TReq" below.
+             *
+             * However, making TReq and TRes constrained types may cause a breaking change for TypeScript users downstream.
+             * So we leave this as a TODO for now, and revisit it in a future major release.
+             */
+            this.proxy.emit('error', err, req, socket);
+        }
+    };
+    /**
+     * Determine whether request should be proxied.
+     */
+    shouldProxy = (pathFilter, req) => {
+        try {
+            return (0, path_filter_1.matchPathFilter)(pathFilter, req.url, req);
+        }
+        catch (err) {
+            (0, debug_1.Debug)('Error: matchPathFilter() called with request url: ', `"${req.url}"`);
+            this.logger.error(err);
+            return false;
+        }
+    };
+    /**
+     * Apply option.router and option.pathRewrite
+     * Order matters:
+     *    Router uses original path for routing;
+     *    NOT the modified path, after it has been rewritten by pathRewrite
+     * @param {Object} req
+     * @return {Object} proxy options
+     */
+    prepareProxyRequest = async (req) => {
+        /**
+         * Incorrect usage confirmed: https://github.com/expressjs/express/issues/4854#issuecomment-1066171160
+         * Temporary restore req.url patch for {@link src/legacy/create-proxy-middleware.ts legacyCreateProxyMiddleware()}
+         * FIXME: remove this patch in future release
+         */
+        if (this.middleware.__LEGACY_HTTP_PROXY_MIDDLEWARE__) {
+            req.url = req.originalUrl || req.url;
+        }
+        const newProxyOptions = Object.assign({}, this.proxyOptions);
+        // Apply in order:
+        // 1. option.router
+        // 2. option.pathRewrite
+        await this.applyRouter(req, newProxyOptions);
+        await this.applyPathRewrite(req, this.pathRewriter);
+        return newProxyOptions;
+    };
+    // Modify option.target when router present.
+    applyRouter = async (req, options) => {
+        let newTarget;
+        if (options.router) {
+            newTarget = await Router.getTarget(req, options);
+            if (newTarget) {
+                (0, debug_1.Debug)('router new target: "%s"', newTarget);
+                options.target = newTarget;
+            }
+        }
+    };
+    // rewrite path
+    applyPathRewrite = async (req, pathRewriter) => {
+        if (pathRewriter) {
+            const path = await pathRewriter(req.url, req);
+            if (typeof path === 'string') {
+                (0, debug_1.Debug)('pathRewrite new path: %s', req.url);
+                req.url = path;
+            }
+            else {
+                (0, debug_1.Debug)('pathRewrite: no rewritten path found: %s', req.url);
+            }
+        }
+    };
 }
 exports.HttpProxyMiddleware = HttpProxyMiddleware;

package/dist/legacy/create-proxy-middleware.d.ts

@@ -1,6 +1,6 @@
+import type * as http from 'node:http';
 import { Filter, RequestHandler } from '../types';
 import { LegacyOptions } from './types';
-import type * as http from 'http';
 /**
  * @deprecated
  * This function is deprecated and will be removed in a future version.

package/dist/legacy/create-proxy-middleware.js

@@ -1,8 +1,8 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.legacyCreateProxyMiddleware = legacyCreateProxyMiddleware;
-const factory_1 = require("../factory");
 const debug_1 = require("../debug");
+const factory_1 = require("../factory");
 const options_adapter_1 = require("./options-adapter");
 const debug = debug_1.Debug.extend('legacy-create-proxy-middleware');
 function legacyCreateProxyMiddleware(legacyContext, legacyOptions) {

package/dist/legacy/options-adapter.js

@@ -1,7 +1,7 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.legacyOptionsAdapter = legacyOptionsAdapter;
-const url = require("url");
+const url = require("node:url");
 const debug_1 = require("../debug");
 const logger_1 = require("../logger");
 const debug = debug_1.Debug.extend('legacy-options-adapter');

package/dist/legacy/types.d.ts

@@ -1,4 +1,4 @@
-import type * as http from 'http';
+import type * as http from 'node:http';
 import { Options } from '../types';
 /**
  * @deprecated

package/dist/path-filter.d.ts

@@ -1,3 +1,3 @@
+import type * as http from 'node:http';
 import type { Filter } from './types';
-import type * as http from 'http';
 export declare function matchPathFilter<TReq = http.IncomingMessage>(pathFilter: Filter<TReq> | undefined, uri: string | undefined, req: http.IncomingMessage): boolean;

package/dist/path-filter.js

@@ -1,9 +1,9 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.matchPathFilter = matchPathFilter;
+const url = require("node:url");
 const isGlob = require("is-glob");
 const micromatch = require("micromatch");
-const url = require("url");
 const errors_1 = require("./errors");
 function matchPathFilter(pathFilter = '/', uri, req) {
     // single path

package/dist/path-rewriter.js

@@ -2,8 +2,8 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.createPathRewriter = createPathRewriter;
 const is_plain_object_1 = require("is-plain-object");
-const errors_1 = require("./errors");
 const debug_1 = require("./debug");
+const errors_1 = require("./errors");
 const debug = debug_1.Debug.extend('path-rewriter');
 /**
  * Create rewrite function, to cache parsed rewrite rules.

package/dist/plugins/default/error-response-plugin.js

@@ -2,6 +2,7 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.errorResponsePlugin = void 0;
 const status_code_1 = require("../../status-code");
+const sanitize_1 = require("../../utils/sanitize");
 function isResponseLike(obj) {
     return obj && typeof obj.writeHead === 'function';
 }
@@ -11,7 +12,7 @@ function isSocketLike(obj) {
 const errorResponsePlugin = (proxyServer, options) => {
     proxyServer.on('error', (err, req, res, target) => {
         // Re-throw error. Not recoverable since req & res are empty.
-        if (!req && !res) {
+        if (!req || !res) {
             throw err; // "Error: Must provide a proper URL as target"
         }
         if (isResponseLike(res)) {
@@ -20,7 +21,7 @@ const errorResponsePlugin = (proxyServer, options) => {
                 res.writeHead(statusCode);
             }
             const host = req.headers && req.headers.host;
-            res.end(`Error occurred while trying to proxy: ${host}${req.url}`);
+            res.end(`Error occurred while trying to proxy: ${(0, sanitize_1.sanitize)(host)}${(0, sanitize_1.sanitize)(req.url)}`);
         }
         else if (isSocketLike(res)) {
             res.destroy();

package/dist/plugins/default/logger-plugin.js

@@ -1,7 +1,7 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.loggerPlugin = void 0;
-const url_1 = require("url");
+const node_url_1 = require("node:url");
 const logger_1 = require("../../logger");
 const logger_plugin_1 = require("../../utils/logger-plugin");
 const loggerPlugin = (proxyServer, options) => {
@@ -34,7 +34,7 @@ const loggerPlugin = (proxyServer, options) => {
                 host: proxyRes.req.host,
                 pathname: proxyRes.req.path,
             };
-            target = new url_1.URL(`${obj.protocol}//${obj.host}${obj.pathname}`);
+            target = new node_url_1.URL(`${obj.protocol}//${obj.host}${obj.pathname}`);
             if (port) {
                 target.port = port;
             }
@@ -43,7 +43,7 @@ const loggerPlugin = (proxyServer, options) => {
         catch (err) {
             // nock issue (https://github.com/chimurai/http-proxy-middleware/issues/1035)
             // fallback to old implementation (less correct - without port)
-            target = new url_1.URL(options.target);
+            target = new node_url_1.URL(options.target);
             target.pathname = proxyRes.req.path;
         }
         const targetUrl = target.toString();

package/dist/plugins/default/proxy-events.js

@@ -25,9 +25,21 @@ const debug = debug_1.Debug.extend('proxy-events-plugin');
  * ```
  */
 const proxyEventsPlugin = (proxyServer, options) => {
-    Object.entries(options.on || {}).forEach(([eventName, handler]) => {
-        debug(`register event handler: "${eventName}" -> "${(0, function_1.getFunctionName)(handler)}"`);
-        proxyServer.on(eventName, handler);
-    });
+    if (!options.on) {
+        return;
+    }
+    // hoist variable here for better typing
+    let eventName;
+    // for in provide better typing than Object.entries()
+    for (eventName in options.on) {
+        if (Object.prototype.hasOwnProperty.call(options.on, eventName)) {
+            const handler = options.on[eventName];
+            if (!handler) {
+                continue;
+            }
+            debug(`register event handler: "${eventName}" -> "${(0, function_1.getFunctionName)(handler)}"`);
+            proxyServer.on(eventName, handler);
+        }
+    }
 };
 exports.proxyEventsPlugin = proxyEventsPlugin;

package/dist/types.d.ts

@@ -2,9 +2,9 @@
  * Based on definition by DefinitelyTyped:
  * https://github.com/DefinitelyTyped/DefinitelyTyped/blob/6f529c6c67a447190f86bfbf894d1061e41e07b7/types/http-proxy-middleware/index.d.ts
  */
-import type * as http from 'http';
-import type * as httpProxy from 'http-proxy';
-import type * as net from 'net';
+import type * as http from 'node:http';
+import type * as net from 'node:net';
+import type { ProxyServer, ProxyServerOptions } from 'httpxy';
 export type NextFunction<T = (err?: any) => void> = T;
 export interface RequestHandler<TReq = http.IncomingMessage, TRes = http.ServerResponse, TNext = NextFunction> {
     (req: TReq, res: TRes, next?: TNext): Promise<void>;
@@ -12,21 +12,21 @@ export interface RequestHandler<TReq = http.IncomingMessage, TRes = http.ServerR
 }
 export type Filter<TReq = http.IncomingMessage> = string | string[] | ((pathname: string, req: TReq) => boolean);
 export interface Plugin<TReq = http.IncomingMessage, TRes = http.ServerResponse> {
-    (proxyServer: httpProxy<TReq, TRes>, options: Options<TReq, TRes>): void;
+    (proxyServer: ProxyServer<TReq, TRes>, options: Options<TReq, TRes>): void;
 }
 export interface OnProxyEvent<TReq = http.IncomingMessage, TRes = http.ServerResponse> {
-    error?: httpProxy.ErrorCallback<Error, TReq, TRes>;
-    proxyReq?: httpProxy.ProxyReqCallback<http.ClientRequest, TReq, TRes>;
-    proxyReqWs?: httpProxy.ProxyReqWsCallback<http.ClientRequest, TReq>;
-    proxyRes?: httpProxy.ProxyResCallback<TReq, TRes>;
-    open?: httpProxy.OpenCallback;
-    close?: httpProxy.CloseCallback<TReq>;
-    start?: httpProxy.StartCallback<TReq, TRes>;
-    end?: httpProxy.EndCallback<TReq, TRes>;
-    econnreset?: httpProxy.EconnresetCallback<Error, TReq, TRes>;
+    error?: (err: Error, req: TReq, res: TRes | net.Socket, target?: string | Partial<URL>) => void;
+    proxyReq?: (proxyReq: http.ClientRequest, req: TReq, res: TRes, options: ProxyServerOptions) => void;
+    proxyReqWs?: (proxyReq: http.ClientRequest, req: TReq, socket: net.Socket, options: ProxyServerOptions, head: any) => void;
+    proxyRes?: (proxyRes: TReq, req: TReq, res: TRes) => void;
+    open?: (proxySocket: net.Socket) => void;
+    close?: (proxyRes: TReq, proxySocket: net.Socket, proxyHead: any) => void;
+    start?: (req: TReq, res: TRes, target: string | Partial<URL>) => void;
+    end?: (req: TReq, res: TRes, proxyRes: TReq) => void;
+    econnreset?: (err: Error, req: TReq, res: TRes, target: string | Partial<URL>) => void;
 }
 export type Logger = Pick<Console, 'info' | 'warn' | 'error'>;
-export interface Options<TReq = http.IncomingMessage, TRes = http.ServerResponse> extends httpProxy.ServerOptions {
+export interface Options<TReq = http.IncomingMessage, TRes = http.ServerResponse> extends ProxyServerOptions {
     /**
      * Narrow down requests to proxy or not.
      * Filter on {@link http.IncomingMessage.url `pathname`} which is relative to the proxy's "mounting" point in the server.
@@ -105,8 +105,8 @@ export interface Options<TReq = http.IncomingMessage, TRes = http.ServerResponse
      * @link https://github.com/chimurai/http-proxy-middleware/blob/master/recipes/router.md
      */
     router?: {
-        [hostOrPath: string]: httpProxy.ServerOptions['target'];
-    } | ((req: TReq) => httpProxy.ServerOptions['target']) | ((req: TReq) => Promise<httpProxy.ServerOptions['target']>);
+        [hostOrPath: string]: ProxyServerOptions['target'];
+    } | ((req: TReq) => ProxyServerOptions['target']) | ((req: TReq) => Promise<ProxyServerOptions['target']>);
     /**
      * Log information from http-proxy-middleware
      * @example
@@ -118,5 +118,5 @@ export interface Options<TReq = http.IncomingMessage, TRes = http.ServerResponse
      * @link https://github.com/chimurai/http-proxy-middleware/blob/master/recipes/logger.md
      * @since v3.0.0
      */
-    logger?: Logger | any;
+    logger?: Logger;
 }

package/dist/types.js

@@ -1,6 +1,2 @@
 "use strict";
-/**
- * Based on definition by DefinitelyTyped:
- * https://github.com/DefinitelyTyped/DefinitelyTyped/blob/6f529c6c67a447190f86bfbf894d1061e41e07b7/types/http-proxy-middleware/index.d.ts
- */
 Object.defineProperty(exports, "__esModule", { value: true });

package/dist/utils/sanitize.d.ts

@@ -0,0 +1 @@
+export declare function sanitize(input: string | undefined): string;

package/dist/utils/sanitize.js

@@ -0,0 +1,6 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.sanitize = sanitize;
+function sanitize(input) {
+    return input?.replace(/[<>]/g, (i) => encodeURIComponent(i)) ?? '';
+}

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "http-proxy-middleware",
   "type": "commonjs",
-  "version": "3.0.4",
+  "version": "4.0.0-beta.0",
   "description": "The one-liner node.js proxy middleware for connect, express, next.js and more",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",
@@ -56,49 +56,50 @@
   },
   "homepage": "https://github.com/chimurai/http-proxy-middleware#readme",
   "devDependencies": {
-    "@commitlint/cli": "19.8.0",
-    "@commitlint/config-conventional": "19.8.0",
-    "@eslint/js": "9.23.0",
+    "@commitlint/cli": "20.4.2",
+    "@commitlint/config-conventional": "20.4.2",
+    "@eslint/js": "10.0.1",
+    "@trivago/prettier-plugin-sort-imports": "6.0.2",
     "@types/debug": "4.1.12",
     "@types/eslint": "9.6.1",
-    "@types/express": "4.17.21",
+    "@types/express": "5.0.6",
     "@types/is-glob": "4.0.4",
-    "@types/jest": "29.5.14",
-    "@types/micromatch": "4.0.9",
-    "@types/node": "22.10.2",
-    "@types/supertest": "6.0.2",
-    "@types/ws": "8.18.0",
-    "body-parser": "1.20.3",
-    "eslint": "9.23.0",
-    "eslint-config-prettier": "10.1.1",
-    "eslint-plugin-prettier": "5.2.3",
-    "express": "4.21.2",
+    "@types/jest": "30.0.0",
+    "@types/micromatch": "4.0.10",
+    "@types/node": "24.10.2",
+    "@types/supertest": "7.2.0",
+    "@types/ws": "8.18.1",
+    "body-parser": "2.2.2",
+    "eslint": "10.0.2",
+    "express": "5.2.1",
     "get-port": "5.1.1",
-    "globals": "16.0.0",
+    "globals": "17.3.0",
     "husky": "9.1.7",
-    "jest": "29.7.0",
-    "lint-staged": "15.5.0",
-    "mockttp": "3.17.0",
+    "jest": "30.2.0",
+    "lint-staged": "16.3.0",
+    "mockttp": "4.2.1",
     "open": "8.4.2",
-    "patch-package": "8.0.0",
-    "pkg-pr-new": "0.0.41",
-    "prettier": "3.5.3",
-    "supertest": "7.1.0",
-    "ts-jest": "29.2.6",
-    "typescript": "5.8.2",
-    "typescript-eslint": "8.27.0",
-    "ws": "8.18.1"
+    "patch-package": "8.0.1",
+    "pkg-pr-new": "0.0.65",
+    "prettier": "3.8.1",
+    "supertest": "7.2.2",
+    "ts-jest": "29.4.6",
+    "typescript": "5.9.3",
+    "typescript-eslint": "8.56.1",
+    "ws": "8.19.0"
   },
   "dependencies": {
-    "@types/http-proxy": "^1.17.15",
     "debug": "^4.3.6",
-    "http-proxy": "^1.18.1",
+    "httpxy": "^0.2.2",
     "is-glob": "^4.0.3",
     "is-plain-object": "^5.0.0",
     "micromatch": "^4.0.8"
   },
+  "resolutions": {
+    "patch-package/**/tmp": "^0.2.4"
+  },
   "engines": {
-    "node": "^14.15.0 || ^16.10.0 || >=18.0.0"
+    "node": ">=20.0.0"
   },
   "commitlint": {
     "extends": [