node-fastify 5.8.3

package/test/request-header-host.test.js

@@ -0,0 +1,339 @@
+'use strict'
+
+const { test } = require('node:test')
+const { connect } = require('node:net')
+const Fastify = require('..')
+
+// RFC9112
+// https://www.rfc-editor.org/rfc/rfc9112
+test('Return 400 when Host header is missing', (t, done) => {
+  t.plan(2)
+  let data = Buffer.alloc(0)
+  const fastify = Fastify()
+
+  t.after(() => fastify.close())
+
+  fastify.get('/', async function () {
+    t.assert.fail('should not reach handler')
+    return { ok: true }
+  })
+  fastify.listen({ port: 0 }, err => {
+    t.assert.ifError(err)
+
+    const socket = connect(fastify.server.address().port)
+    socket.write('GET / HTTP/1.1\r\n\r\n')
+    socket.on('data', c => (data = Buffer.concat([data, c])))
+    socket.on('end', () => {
+      t.assert.match(
+        data.toString('utf-8'),
+        /^HTTP\/1.1 400 Bad Request/
+      )
+      done()
+    })
+  })
+})
+
+test('Return 400 when Host header is missing with trust proxy', (t, done) => {
+  t.plan(2)
+  let data = Buffer.alloc(0)
+  const fastify = Fastify({
+    trustProxy: true
+  })
+
+  t.after(() => fastify.close())
+
+  fastify.get('/', async function () {
+    t.assert.fail('should not reach handler')
+    return { ok: true }
+  })
+  fastify.listen({ port: 0 }, err => {
+    t.assert.ifError(err)
+
+    const socket = connect(fastify.server.address().port)
+    socket.write('GET / HTTP/1.1\r\n\r\n')
+    socket.on('data', c => (data = Buffer.concat([data, c])))
+    socket.on('end', () => {
+      t.assert.match(
+        data.toString('utf-8'),
+        /^HTTP\/1.1 400 Bad Request/
+      )
+      done()
+    })
+  })
+})
+
+test('Return 200 when Host header is empty', (t, done) => {
+  t.plan(5)
+  let data = Buffer.alloc(0)
+  const fastify = Fastify({
+    keepAliveTimeout: 10
+  })
+
+  t.after(() => fastify.close())
+
+  fastify.get('/', async function (request) {
+    t.assert.strictEqual(request.host, '')
+    t.assert.strictEqual(request.hostname, '')
+    t.assert.strictEqual(request.port, null)
+    return { ok: true }
+  })
+  fastify.listen({ port: 0 }, err => {
+    t.assert.ifError(err)
+
+    const socket = connect(fastify.server.address().port)
+    socket.write('GET / HTTP/1.1\r\nHost:\r\n\r\n')
+    socket.on('data', c => (data = Buffer.concat([data, c])))
+    socket.on('end', () => {
+      t.assert.match(
+        data.toString('utf-8'),
+        /^HTTP\/1.1 200 OK/
+      )
+      done()
+    })
+  })
+})
+
+test('Return 200 when Host header is empty with trust proxy', (t, done) => {
+  t.plan(5)
+  let data = Buffer.alloc(0)
+  const fastify = Fastify({
+    trustProxy: true,
+    keepAliveTimeout: 10
+  })
+
+  t.after(() => fastify.close())
+
+  fastify.get('/', async function (request) {
+    t.assert.strictEqual(request.host, '')
+    t.assert.strictEqual(request.hostname, '')
+    t.assert.strictEqual(request.port, null)
+    return { ok: true }
+  })
+  fastify.listen({ port: 0 }, err => {
+    t.assert.ifError(err)
+
+    const socket = connect(fastify.server.address().port)
+    socket.write('GET / HTTP/1.1\r\nHost:\r\n\r\n')
+    socket.on('data', c => (data = Buffer.concat([data, c])))
+    socket.on('end', () => {
+      t.assert.match(
+        data.toString('utf-8'),
+        /^HTTP\/1.1 200 OK/
+      )
+      done()
+    })
+  })
+})
+
+// Node.js allows exploiting RFC9112
+// https://nodejs.org/docs/latest-v22.x/api/http.html#httpcreateserveroptions-requestlistener
+test('Return 200 when Host header is missing and http.requireHostHeader = false', (t, done) => {
+  t.plan(5)
+  let data = Buffer.alloc(0)
+  const fastify = Fastify({
+    http: {
+      requireHostHeader: false
+    },
+    keepAliveTimeout: 10
+  })
+
+  t.after(() => fastify.close())
+
+  fastify.get('/', async function (request) {
+    t.assert.strictEqual(request.host, '')
+    t.assert.strictEqual(request.hostname, '')
+    t.assert.strictEqual(request.port, null)
+    return { ok: true }
+  })
+  fastify.listen({ port: 0 }, err => {
+    t.assert.ifError(err)
+
+    const socket = connect(fastify.server.address().port)
+    socket.write('GET / HTTP/1.1\r\n\r\n')
+    socket.on('data', c => (data = Buffer.concat([data, c])))
+    socket.on('end', () => {
+      t.assert.match(
+        data.toString('utf-8'),
+        /^HTTP\/1.1 200 OK/
+      )
+      done()
+    })
+  })
+})
+
+test('Return 200 when Host header is missing and http.requireHostHeader = false with trust proxy', (t, done) => {
+  t.plan(5)
+  let data = Buffer.alloc(0)
+  const fastify = Fastify({
+    http: {
+      requireHostHeader: false
+    },
+    trustProxy: true,
+    keepAliveTimeout: 10
+  })
+
+  t.after(() => fastify.close())
+
+  fastify.get('/', async function (request) {
+    t.assert.strictEqual(request.host, '')
+    t.assert.strictEqual(request.hostname, '')
+    t.assert.strictEqual(request.port, null)
+    return { ok: true }
+  })
+  fastify.listen({ port: 0 }, err => {
+    t.assert.ifError(err)
+
+    const socket = connect(fastify.server.address().port)
+    socket.write('GET / HTTP/1.1\r\n\r\n')
+    socket.on('data', c => (data = Buffer.concat([data, c])))
+    socket.on('end', () => {
+      t.assert.match(
+        data.toString('utf-8'),
+        /^HTTP\/1.1 200 OK/
+      )
+      done()
+    })
+  })
+})
+
+test('Return 200 when Host header is missing using HTTP/1.0', (t, done) => {
+  t.plan(5)
+  let data = Buffer.alloc(0)
+  const fastify = Fastify({
+    keepAliveTimeout: 10
+  })
+
+  t.after(() => fastify.close())
+
+  fastify.get('/', async function (request) {
+    t.assert.strictEqual(request.host, '')
+    t.assert.strictEqual(request.hostname, '')
+    t.assert.strictEqual(request.port, null)
+    return { ok: true }
+  })
+  fastify.listen({ port: 0 }, err => {
+    t.assert.ifError(err)
+
+    const socket = connect(fastify.server.address().port)
+    socket.write('GET / HTTP/1.0\r\n\r\n')
+    socket.on('data', c => (data = Buffer.concat([data, c])))
+    socket.on('end', () => {
+      t.assert.match(
+        data.toString('utf-8'),
+        /^HTTP\/1.1 200 OK/
+      )
+      done()
+    })
+  })
+})
+
+test('Return 200 when Host header is missing with trust proxy using HTTP/1.0', (t, done) => {
+  t.plan(5)
+  let data = Buffer.alloc(0)
+  const fastify = Fastify({
+    trustProxy: true,
+    keepAliveTimeout: 10
+  })
+
+  t.after(() => fastify.close())
+
+  fastify.get('/', async function (request) {
+    t.assert.strictEqual(request.host, '')
+    t.assert.strictEqual(request.hostname, '')
+    t.assert.strictEqual(request.port, null)
+    return { ok: true }
+  })
+  fastify.listen({ port: 0 }, err => {
+    t.assert.ifError(err)
+
+    const socket = connect(fastify.server.address().port)
+    socket.write('GET / HTTP/1.0\r\n\r\n')
+    socket.on('data', c => (data = Buffer.concat([data, c])))
+    socket.on('end', () => {
+      t.assert.match(
+        data.toString('utf-8'),
+        /^HTTP\/1.1 200 OK/
+      )
+      done()
+    })
+  })
+})
+
+test('Return 200 when Host header is removed by schema', (t, done) => {
+  t.plan(5)
+  let data = Buffer.alloc(0)
+  const fastify = Fastify({
+    keepAliveTimeout: 10
+  })
+
+  t.after(() => fastify.close())
+
+  fastify.get('/', {
+    schema: {
+      headers: {
+        type: 'object',
+        properties: {},
+        additionalProperties: false
+      }
+    }
+  }, async function (request) {
+    t.assert.strictEqual(request.host, '')
+    t.assert.strictEqual(request.hostname, '')
+    t.assert.strictEqual(request.port, null)
+    return { ok: true }
+  })
+  fastify.listen({ port: 0 }, err => {
+    t.assert.ifError(err)
+
+    const socket = connect(fastify.server.address().port)
+    socket.write('GET / HTTP/1.1\r\nHost: localhost\r\n\r\n')
+    socket.on('data', c => (data = Buffer.concat([data, c])))
+    socket.on('end', () => {
+      t.assert.match(
+        data.toString('utf-8'),
+        /^HTTP\/1.1 200 OK/
+      )
+      done()
+    })
+  })
+})
+
+test('Return 200 when Host header is removed by schema with trust proxy', (t, done) => {
+  t.plan(5)
+  let data = Buffer.alloc(0)
+  const fastify = Fastify({
+    trustProxy: true,
+    keepAliveTimeout: 10
+  })
+
+  t.after(() => fastify.close())
+
+  fastify.get('/', {
+    schema: {
+      headers: {
+        type: 'object',
+        properties: {},
+        additionalProperties: false
+      }
+    }
+  }, async function (request) {
+    t.assert.strictEqual(request.host, '')
+    t.assert.strictEqual(request.hostname, '')
+    t.assert.strictEqual(request.port, null)
+    return { ok: true }
+  })
+  fastify.listen({ port: 0 }, err => {
+    t.assert.ifError(err)
+
+    const socket = connect(fastify.server.address().port)
+    socket.write('GET / HTTP/1.1\r\nHost: localhost\r\n\r\n')
+    socket.on('data', c => (data = Buffer.concat([data, c])))
+    socket.on('end', () => {
+      t.assert.match(
+        data.toString('utf-8'),
+        /^HTTP\/1.1 200 OK/
+      )
+      done()
+    })
+  })
+})

package/test/request-id.test.js

@@ -0,0 +1,118 @@
+'use strict'
+
+const { test } = require('node:test')
+const Fastify = require('..')
+
+test('The request id header key can be customized', async (t) => {
+  t.plan(2)
+  const REQUEST_ID = '42'
+
+  const fastify = Fastify({
+    requestIdHeader: 'my-custom-request-id'
+  })
+
+  fastify.get('/', (req, reply) => {
+    t.assert.strictEqual(req.id, REQUEST_ID)
+    reply.send({ id: req.id })
+  })
+
+  const response = await fastify.inject({ method: 'GET', url: '/', headers: { 'my-custom-request-id': REQUEST_ID } })
+  const body = await response.json()
+  t.assert.strictEqual(body.id, REQUEST_ID)
+})
+
+test('The request id header key can be customized', async (t) => {
+  t.plan(2)
+  const REQUEST_ID = '42'
+
+  const fastify = Fastify({
+    requestIdHeader: 'my-custom-request-id'
+  })
+
+  fastify.get('/', (req, reply) => {
+    t.assert.strictEqual(req.id, REQUEST_ID)
+    reply.send({ id: req.id })
+  })
+
+  const response = await fastify.inject({ method: 'GET', url: '/', headers: { 'MY-CUSTOM-REQUEST-ID': REQUEST_ID } })
+  const body = await response.json()
+  t.assert.strictEqual(body.id, REQUEST_ID)
+})
+
+test('The request id header key can be customized', async (t) => {
+  t.plan(3)
+  const REQUEST_ID = '42'
+
+  const fastify = Fastify({
+    requestIdHeader: 'my-custom-request-id'
+  })
+
+  fastify.get('/', (req, reply) => {
+    t.assert.strictEqual(req.id, REQUEST_ID)
+    reply.send({ id: req.id })
+  })
+
+  t.after(() => fastify.close())
+
+  const fastifyServer = await fastify.listen({ port: 0 })
+
+  const result = await fetch(fastifyServer, {
+    headers: {
+      'my-custom-request-id': REQUEST_ID
+    }
+  })
+  t.assert.ok(result.ok)
+  t.assert.deepStrictEqual(await result.json(), { id: REQUEST_ID })
+})
+
+test('The request id header key can be customized', async (t) => {
+  t.plan(3)
+  const REQUEST_ID = '42'
+
+  const fastify = Fastify({
+    requestIdHeader: 'my-custom-request-id'
+  })
+
+  fastify.get('/', (req, reply) => {
+    t.assert.strictEqual(req.id, REQUEST_ID)
+    reply.send({ id: req.id })
+  })
+
+  t.after(() => fastify.close())
+
+  const fastifyServer = await fastify.listen({ port: 0 })
+
+  const result = await fetch(fastifyServer, {
+    headers: {
+      'MY-CUSTOM-REQUEST-ID': REQUEST_ID
+    }
+  })
+  t.assert.ok(result.ok)
+  t.assert.deepStrictEqual(await result.json(), { id: REQUEST_ID })
+})
+
+test('The request id header key can be customized', async (t) => {
+  t.plan(3)
+  const REQUEST_ID = '42'
+
+  const fastify = Fastify({
+    requestIdHeader: 'MY-CUSTOM-REQUEST-ID'
+  })
+
+  fastify.get('/', (req, reply) => {
+    t.assert.strictEqual(req.id, REQUEST_ID)
+    reply.send({ id: req.id })
+  })
+
+  t.after(() => fastify.close())
+
+  const fastifyServer = await fastify.listen({ port: 0 })
+
+  const result = await fetch(fastifyServer, {
+    headers: {
+      'MY-CUSTOM-REQUEST-ID': REQUEST_ID
+    }
+  })
+  t.assert.ok(result.ok)
+  t.assert.deepStrictEqual(await result.json(), { id: REQUEST_ID })
+})

package/test/request-timeout.test.js

@@ -0,0 +1,53 @@
+'use strict'
+
+const http = require('node:http')
+const { test } = require('node:test')
+const Fastify = require('..')
+
+test('requestTimeout passed to server', t => {
+  t.plan(5)
+
+  try {
+    Fastify({ requestTimeout: 500.1 })
+    t.assert.fail('option must be an integer')
+  } catch (err) {
+    t.assert.ok(err)
+  }
+
+  try {
+    Fastify({ requestTimeout: [] })
+    t.assert.fail('option must be an integer')
+  } catch (err) {
+    t.assert.ok(err)
+  }
+
+  const httpServer = Fastify({ requestTimeout: 1000 }).server
+  t.assert.strictEqual(httpServer.requestTimeout, 1000)
+
+  const httpsServer = Fastify({ requestTimeout: 1000, https: true }).server
+  t.assert.strictEqual(httpsServer.requestTimeout, 1000)
+
+  const serverFactory = (handler, _) => {
+    const server = http.createServer((req, res) => {
+      handler(req, res)
+    })
+    server.requestTimeout = 5000
+    return server
+  }
+  const customServer = Fastify({ requestTimeout: 4000, serverFactory }).server
+  t.assert.strictEqual(customServer.requestTimeout, 5000)
+})
+
+test('requestTimeout should be set', async (t) => {
+  t.plan(1)
+
+  const initialConfig = Fastify({ requestTimeout: 5000 }).initialConfig
+  t.assert.strictEqual(initialConfig.requestTimeout, 5000)
+})
+
+test('requestTimeout should 0', async (t) => {
+  t.plan(1)
+
+  const initialConfig = Fastify().initialConfig
+  t.assert.strictEqual(initialConfig.requestTimeout, 0)
+})