1 |
3a515b92
|
cagy
|
/*!
|
2 |
|
|
* express
|
3 |
|
|
* Copyright(c) 2009-2013 TJ Holowaychuk
|
4 |
|
|
* Copyright(c) 2013 Roman Shtylman
|
5 |
|
|
* Copyright(c) 2014-2015 Douglas Christopher Wilson
|
6 |
|
|
* MIT Licensed
|
7 |
|
|
*/
|
8 |
|
|
|
9 |
|
|
'use strict';
|
10 |
|
|
|
11 |
|
|
/**
|
12 |
|
|
* Module dependencies.
|
13 |
|
|
* @private
|
14 |
|
|
*/
|
15 |
|
|
|
16 |
|
|
var accepts = require('accepts');
|
17 |
|
|
var deprecate = require('depd')('express');
|
18 |
|
|
var isIP = require('net').isIP;
|
19 |
|
|
var typeis = require('type-is');
|
20 |
|
|
var http = require('http');
|
21 |
|
|
var fresh = require('fresh');
|
22 |
|
|
var parseRange = require('range-parser');
|
23 |
|
|
var parse = require('parseurl');
|
24 |
|
|
var proxyaddr = require('proxy-addr');
|
25 |
|
|
|
26 |
|
|
/**
|
27 |
|
|
* Request prototype.
|
28 |
|
|
* @public
|
29 |
|
|
*/
|
30 |
|
|
|
31 |
|
|
var req = Object.create(http.IncomingMessage.prototype)
|
32 |
|
|
|
33 |
|
|
/**
|
34 |
|
|
* Module exports.
|
35 |
|
|
* @public
|
36 |
|
|
*/
|
37 |
|
|
|
38 |
|
|
module.exports = req
|
39 |
|
|
|
40 |
|
|
/**
|
41 |
|
|
* Return request header.
|
42 |
|
|
*
|
43 |
|
|
* The `Referrer` header field is special-cased,
|
44 |
|
|
* both `Referrer` and `Referer` are interchangeable.
|
45 |
|
|
*
|
46 |
|
|
* Examples:
|
47 |
|
|
*
|
48 |
|
|
* req.get('Content-Type');
|
49 |
|
|
* // => "text/plain"
|
50 |
|
|
*
|
51 |
|
|
* req.get('content-type');
|
52 |
|
|
* // => "text/plain"
|
53 |
|
|
*
|
54 |
|
|
* req.get('Something');
|
55 |
|
|
* // => undefined
|
56 |
|
|
*
|
57 |
|
|
* Aliased as `req.header()`.
|
58 |
|
|
*
|
59 |
|
|
* @param {String} name
|
60 |
|
|
* @return {String}
|
61 |
|
|
* @public
|
62 |
|
|
*/
|
63 |
|
|
|
64 |
|
|
req.get =
|
65 |
|
|
req.header = function header(name) {
|
66 |
|
|
if (!name) {
|
67 |
|
|
throw new TypeError('name argument is required to req.get');
|
68 |
|
|
}
|
69 |
|
|
|
70 |
|
|
if (typeof name !== 'string') {
|
71 |
|
|
throw new TypeError('name must be a string to req.get');
|
72 |
|
|
}
|
73 |
|
|
|
74 |
|
|
var lc = name.toLowerCase();
|
75 |
|
|
|
76 |
|
|
switch (lc) {
|
77 |
|
|
case 'referer':
|
78 |
|
|
case 'referrer':
|
79 |
|
|
return this.headers.referrer
|
80 |
|
|
|| this.headers.referer;
|
81 |
|
|
default:
|
82 |
|
|
return this.headers[lc];
|
83 |
|
|
}
|
84 |
|
|
};
|
85 |
|
|
|
86 |
|
|
/**
|
87 |
|
|
* To do: update docs.
|
88 |
|
|
*
|
89 |
|
|
* Check if the given `type(s)` is acceptable, returning
|
90 |
|
|
* the best match when true, otherwise `undefined`, in which
|
91 |
|
|
* case you should respond with 406 "Not Acceptable".
|
92 |
|
|
*
|
93 |
|
|
* The `type` value may be a single MIME type string
|
94 |
|
|
* such as "application/json", an extension name
|
95 |
|
|
* such as "json", a comma-delimited list such as "json, html, text/plain",
|
96 |
|
|
* an argument list such as `"json", "html", "text/plain"`,
|
97 |
|
|
* or an array `["json", "html", "text/plain"]`. When a list
|
98 |
|
|
* or array is given, the _best_ match, if any is returned.
|
99 |
|
|
*
|
100 |
|
|
* Examples:
|
101 |
|
|
*
|
102 |
|
|
* // Accept: text/html
|
103 |
|
|
* req.accepts('html');
|
104 |
|
|
* // => "html"
|
105 |
|
|
*
|
106 |
|
|
* // Accept: text/*, application/json
|
107 |
|
|
* req.accepts('html');
|
108 |
|
|
* // => "html"
|
109 |
|
|
* req.accepts('text/html');
|
110 |
|
|
* // => "text/html"
|
111 |
|
|
* req.accepts('json, text');
|
112 |
|
|
* // => "json"
|
113 |
|
|
* req.accepts('application/json');
|
114 |
|
|
* // => "application/json"
|
115 |
|
|
*
|
116 |
|
|
* // Accept: text/*, application/json
|
117 |
|
|
* req.accepts('image/png');
|
118 |
|
|
* req.accepts('png');
|
119 |
|
|
* // => undefined
|
120 |
|
|
*
|
121 |
|
|
* // Accept: text/*;q=.5, application/json
|
122 |
|
|
* req.accepts(['html', 'json']);
|
123 |
|
|
* req.accepts('html', 'json');
|
124 |
|
|
* req.accepts('html, json');
|
125 |
|
|
* // => "json"
|
126 |
|
|
*
|
127 |
|
|
* @param {String|Array} type(s)
|
128 |
|
|
* @return {String|Array|Boolean}
|
129 |
|
|
* @public
|
130 |
|
|
*/
|
131 |
|
|
|
132 |
|
|
req.accepts = function(){
|
133 |
|
|
var accept = accepts(this);
|
134 |
|
|
return accept.types.apply(accept, arguments);
|
135 |
|
|
};
|
136 |
|
|
|
137 |
|
|
/**
|
138 |
|
|
* Check if the given `encoding`s are accepted.
|
139 |
|
|
*
|
140 |
|
|
* @param {String} ...encoding
|
141 |
|
|
* @return {String|Array}
|
142 |
|
|
* @public
|
143 |
|
|
*/
|
144 |
|
|
|
145 |
|
|
req.acceptsEncodings = function(){
|
146 |
|
|
var accept = accepts(this);
|
147 |
|
|
return accept.encodings.apply(accept, arguments);
|
148 |
|
|
};
|
149 |
|
|
|
150 |
|
|
req.acceptsEncoding = deprecate.function(req.acceptsEncodings,
|
151 |
|
|
'req.acceptsEncoding: Use acceptsEncodings instead');
|
152 |
|
|
|
153 |
|
|
/**
|
154 |
|
|
* Check if the given `charset`s are acceptable,
|
155 |
|
|
* otherwise you should respond with 406 "Not Acceptable".
|
156 |
|
|
*
|
157 |
|
|
* @param {String} ...charset
|
158 |
|
|
* @return {String|Array}
|
159 |
|
|
* @public
|
160 |
|
|
*/
|
161 |
|
|
|
162 |
|
|
req.acceptsCharsets = function(){
|
163 |
|
|
var accept = accepts(this);
|
164 |
|
|
return accept.charsets.apply(accept, arguments);
|
165 |
|
|
};
|
166 |
|
|
|
167 |
|
|
req.acceptsCharset = deprecate.function(req.acceptsCharsets,
|
168 |
|
|
'req.acceptsCharset: Use acceptsCharsets instead');
|
169 |
|
|
|
170 |
|
|
/**
|
171 |
|
|
* Check if the given `lang`s are acceptable,
|
172 |
|
|
* otherwise you should respond with 406 "Not Acceptable".
|
173 |
|
|
*
|
174 |
|
|
* @param {String} ...lang
|
175 |
|
|
* @return {String|Array}
|
176 |
|
|
* @public
|
177 |
|
|
*/
|
178 |
|
|
|
179 |
|
|
req.acceptsLanguages = function(){
|
180 |
|
|
var accept = accepts(this);
|
181 |
|
|
return accept.languages.apply(accept, arguments);
|
182 |
|
|
};
|
183 |
|
|
|
184 |
|
|
req.acceptsLanguage = deprecate.function(req.acceptsLanguages,
|
185 |
|
|
'req.acceptsLanguage: Use acceptsLanguages instead');
|
186 |
|
|
|
187 |
|
|
/**
|
188 |
|
|
* Parse Range header field, capping to the given `size`.
|
189 |
|
|
*
|
190 |
|
|
* Unspecified ranges such as "0-" require knowledge of your resource length. In
|
191 |
|
|
* the case of a byte range this is of course the total number of bytes. If the
|
192 |
|
|
* Range header field is not given `undefined` is returned, `-1` when unsatisfiable,
|
193 |
|
|
* and `-2` when syntactically invalid.
|
194 |
|
|
*
|
195 |
|
|
* When ranges are returned, the array has a "type" property which is the type of
|
196 |
|
|
* range that is required (most commonly, "bytes"). Each array element is an object
|
197 |
|
|
* with a "start" and "end" property for the portion of the range.
|
198 |
|
|
*
|
199 |
|
|
* The "combine" option can be set to `true` and overlapping & adjacent ranges
|
200 |
|
|
* will be combined into a single range.
|
201 |
|
|
*
|
202 |
|
|
* NOTE: remember that ranges are inclusive, so for example "Range: users=0-3"
|
203 |
|
|
* should respond with 4 users when available, not 3.
|
204 |
|
|
*
|
205 |
|
|
* @param {number} size
|
206 |
|
|
* @param {object} [options]
|
207 |
|
|
* @param {boolean} [options.combine=false]
|
208 |
|
|
* @return {number|array}
|
209 |
|
|
* @public
|
210 |
|
|
*/
|
211 |
|
|
|
212 |
|
|
req.range = function range(size, options) {
|
213 |
|
|
var range = this.get('Range');
|
214 |
|
|
if (!range) return;
|
215 |
|
|
return parseRange(size, range, options);
|
216 |
|
|
};
|
217 |
|
|
|
218 |
|
|
/**
|
219 |
|
|
* Return the value of param `name` when present or `defaultValue`.
|
220 |
|
|
*
|
221 |
|
|
* - Checks route placeholders, ex: _/user/:id_
|
222 |
|
|
* - Checks body params, ex: id=12, {"id":12}
|
223 |
|
|
* - Checks query string params, ex: ?id=12
|
224 |
|
|
*
|
225 |
|
|
* To utilize request bodies, `req.body`
|
226 |
|
|
* should be an object. This can be done by using
|
227 |
|
|
* the `bodyParser()` middleware.
|
228 |
|
|
*
|
229 |
|
|
* @param {String} name
|
230 |
|
|
* @param {Mixed} [defaultValue]
|
231 |
|
|
* @return {String}
|
232 |
|
|
* @public
|
233 |
|
|
*/
|
234 |
|
|
|
235 |
|
|
req.param = function param(name, defaultValue) {
|
236 |
|
|
var params = this.params || {};
|
237 |
|
|
var body = this.body || {};
|
238 |
|
|
var query = this.query || {};
|
239 |
|
|
|
240 |
|
|
var args = arguments.length === 1
|
241 |
|
|
? 'name'
|
242 |
|
|
: 'name, default';
|
243 |
|
|
deprecate('req.param(' + args + '): Use req.params, req.body, or req.query instead');
|
244 |
|
|
|
245 |
|
|
if (null != params[name] && params.hasOwnProperty(name)) return params[name];
|
246 |
|
|
if (null != body[name]) return body[name];
|
247 |
|
|
if (null != query[name]) return query[name];
|
248 |
|
|
|
249 |
|
|
return defaultValue;
|
250 |
|
|
};
|
251 |
|
|
|
252 |
|
|
/**
|
253 |
|
|
* Check if the incoming request contains the "Content-Type"
|
254 |
|
|
* header field, and it contains the give mime `type`.
|
255 |
|
|
*
|
256 |
|
|
* Examples:
|
257 |
|
|
*
|
258 |
|
|
* // With Content-Type: text/html; charset=utf-8
|
259 |
|
|
* req.is('html');
|
260 |
|
|
* req.is('text/html');
|
261 |
|
|
* req.is('text/*');
|
262 |
|
|
* // => true
|
263 |
|
|
*
|
264 |
|
|
* // When Content-Type is application/json
|
265 |
|
|
* req.is('json');
|
266 |
|
|
* req.is('application/json');
|
267 |
|
|
* req.is('application/*');
|
268 |
|
|
* // => true
|
269 |
|
|
*
|
270 |
|
|
* req.is('html');
|
271 |
|
|
* // => false
|
272 |
|
|
*
|
273 |
|
|
* @param {String|Array} types...
|
274 |
|
|
* @return {String|false|null}
|
275 |
|
|
* @public
|
276 |
|
|
*/
|
277 |
|
|
|
278 |
|
|
req.is = function is(types) {
|
279 |
|
|
var arr = types;
|
280 |
|
|
|
281 |
|
|
// support flattened arguments
|
282 |
|
|
if (!Array.isArray(types)) {
|
283 |
|
|
arr = new Array(arguments.length);
|
284 |
|
|
for (var i = 0; i < arr.length; i++) {
|
285 |
|
|
arr[i] = arguments[i];
|
286 |
|
|
}
|
287 |
|
|
}
|
288 |
|
|
|
289 |
|
|
return typeis(this, arr);
|
290 |
|
|
};
|
291 |
|
|
|
292 |
|
|
/**
|
293 |
|
|
* Return the protocol string "http" or "https"
|
294 |
|
|
* when requested with TLS. When the "trust proxy"
|
295 |
|
|
* setting trusts the socket address, the
|
296 |
|
|
* "X-Forwarded-Proto" header field will be trusted
|
297 |
|
|
* and used if present.
|
298 |
|
|
*
|
299 |
|
|
* If you're running behind a reverse proxy that
|
300 |
|
|
* supplies https for you this may be enabled.
|
301 |
|
|
*
|
302 |
|
|
* @return {String}
|
303 |
|
|
* @public
|
304 |
|
|
*/
|
305 |
|
|
|
306 |
|
|
defineGetter(req, 'protocol', function protocol(){
|
307 |
|
|
var proto = this.connection.encrypted
|
308 |
|
|
? 'https'
|
309 |
|
|
: 'http';
|
310 |
|
|
var trust = this.app.get('trust proxy fn');
|
311 |
|
|
|
312 |
|
|
if (!trust(this.connection.remoteAddress, 0)) {
|
313 |
|
|
return proto;
|
314 |
|
|
}
|
315 |
|
|
|
316 |
|
|
// Note: X-Forwarded-Proto is normally only ever a
|
317 |
|
|
// single value, but this is to be safe.
|
318 |
|
|
var header = this.get('X-Forwarded-Proto') || proto
|
319 |
|
|
var index = header.indexOf(',')
|
320 |
|
|
|
321 |
|
|
return index !== -1
|
322 |
|
|
? header.substring(0, index).trim()
|
323 |
|
|
: header.trim()
|
324 |
|
|
});
|
325 |
|
|
|
326 |
|
|
/**
|
327 |
|
|
* Short-hand for:
|
328 |
|
|
*
|
329 |
|
|
* req.protocol === 'https'
|
330 |
|
|
*
|
331 |
|
|
* @return {Boolean}
|
332 |
|
|
* @public
|
333 |
|
|
*/
|
334 |
|
|
|
335 |
|
|
defineGetter(req, 'secure', function secure(){
|
336 |
|
|
return this.protocol === 'https';
|
337 |
|
|
});
|
338 |
|
|
|
339 |
|
|
/**
|
340 |
|
|
* Return the remote address from the trusted proxy.
|
341 |
|
|
*
|
342 |
|
|
* The is the remote address on the socket unless
|
343 |
|
|
* "trust proxy" is set.
|
344 |
|
|
*
|
345 |
|
|
* @return {String}
|
346 |
|
|
* @public
|
347 |
|
|
*/
|
348 |
|
|
|
349 |
|
|
defineGetter(req, 'ip', function ip(){
|
350 |
|
|
var trust = this.app.get('trust proxy fn');
|
351 |
|
|
return proxyaddr(this, trust);
|
352 |
|
|
});
|
353 |
|
|
|
354 |
|
|
/**
|
355 |
|
|
* When "trust proxy" is set, trusted proxy addresses + client.
|
356 |
|
|
*
|
357 |
|
|
* For example if the value were "client, proxy1, proxy2"
|
358 |
|
|
* you would receive the array `["client", "proxy1", "proxy2"]`
|
359 |
|
|
* where "proxy2" is the furthest down-stream and "proxy1" and
|
360 |
|
|
* "proxy2" were trusted.
|
361 |
|
|
*
|
362 |
|
|
* @return {Array}
|
363 |
|
|
* @public
|
364 |
|
|
*/
|
365 |
|
|
|
366 |
|
|
defineGetter(req, 'ips', function ips() {
|
367 |
|
|
var trust = this.app.get('trust proxy fn');
|
368 |
|
|
var addrs = proxyaddr.all(this, trust);
|
369 |
|
|
|
370 |
|
|
// reverse the order (to farthest -> closest)
|
371 |
|
|
// and remove socket address
|
372 |
|
|
addrs.reverse().pop()
|
373 |
|
|
|
374 |
|
|
return addrs
|
375 |
|
|
});
|
376 |
|
|
|
377 |
|
|
/**
|
378 |
|
|
* Return subdomains as an array.
|
379 |
|
|
*
|
380 |
|
|
* Subdomains are the dot-separated parts of the host before the main domain of
|
381 |
|
|
* the app. By default, the domain of the app is assumed to be the last two
|
382 |
|
|
* parts of the host. This can be changed by setting "subdomain offset".
|
383 |
|
|
*
|
384 |
|
|
* For example, if the domain is "tobi.ferrets.example.com":
|
385 |
|
|
* If "subdomain offset" is not set, req.subdomains is `["ferrets", "tobi"]`.
|
386 |
|
|
* If "subdomain offset" is 3, req.subdomains is `["tobi"]`.
|
387 |
|
|
*
|
388 |
|
|
* @return {Array}
|
389 |
|
|
* @public
|
390 |
|
|
*/
|
391 |
|
|
|
392 |
|
|
defineGetter(req, 'subdomains', function subdomains() {
|
393 |
|
|
var hostname = this.hostname;
|
394 |
|
|
|
395 |
|
|
if (!hostname) return [];
|
396 |
|
|
|
397 |
|
|
var offset = this.app.get('subdomain offset');
|
398 |
|
|
var subdomains = !isIP(hostname)
|
399 |
|
|
? hostname.split('.').reverse()
|
400 |
|
|
: [hostname];
|
401 |
|
|
|
402 |
|
|
return subdomains.slice(offset);
|
403 |
|
|
});
|
404 |
|
|
|
405 |
|
|
/**
|
406 |
|
|
* Short-hand for `url.parse(req.url).pathname`.
|
407 |
|
|
*
|
408 |
|
|
* @return {String}
|
409 |
|
|
* @public
|
410 |
|
|
*/
|
411 |
|
|
|
412 |
|
|
defineGetter(req, 'path', function path() {
|
413 |
|
|
return parse(this).pathname;
|
414 |
|
|
});
|
415 |
|
|
|
416 |
|
|
/**
|
417 |
|
|
* Parse the "Host" header field to a hostname.
|
418 |
|
|
*
|
419 |
|
|
* When the "trust proxy" setting trusts the socket
|
420 |
|
|
* address, the "X-Forwarded-Host" header field will
|
421 |
|
|
* be trusted.
|
422 |
|
|
*
|
423 |
|
|
* @return {String}
|
424 |
|
|
* @public
|
425 |
|
|
*/
|
426 |
|
|
|
427 |
|
|
defineGetter(req, 'hostname', function hostname(){
|
428 |
|
|
var trust = this.app.get('trust proxy fn');
|
429 |
|
|
var host = this.get('X-Forwarded-Host');
|
430 |
|
|
|
431 |
|
|
if (!host || !trust(this.connection.remoteAddress, 0)) {
|
432 |
|
|
host = this.get('Host');
|
433 |
|
|
} else if (host.indexOf(',') !== -1) {
|
434 |
|
|
// Note: X-Forwarded-Host is normally only ever a
|
435 |
|
|
// single value, but this is to be safe.
|
436 |
|
|
host = host.substring(0, host.indexOf(',')).trimRight()
|
437 |
|
|
}
|
438 |
|
|
|
439 |
|
|
if (!host) return;
|
440 |
|
|
|
441 |
|
|
// IPv6 literal support
|
442 |
|
|
var offset = host[0] === '['
|
443 |
|
|
? host.indexOf(']') + 1
|
444 |
|
|
: 0;
|
445 |
|
|
var index = host.indexOf(':', offset);
|
446 |
|
|
|
447 |
|
|
return index !== -1
|
448 |
|
|
? host.substring(0, index)
|
449 |
|
|
: host;
|
450 |
|
|
});
|
451 |
|
|
|
452 |
|
|
// TODO: change req.host to return host in next major
|
453 |
|
|
|
454 |
|
|
defineGetter(req, 'host', deprecate.function(function host(){
|
455 |
|
|
return this.hostname;
|
456 |
|
|
}, 'req.host: Use req.hostname instead'));
|
457 |
|
|
|
458 |
|
|
/**
|
459 |
|
|
* Check if the request is fresh, aka
|
460 |
|
|
* Last-Modified and/or the ETag
|
461 |
|
|
* still match.
|
462 |
|
|
*
|
463 |
|
|
* @return {Boolean}
|
464 |
|
|
* @public
|
465 |
|
|
*/
|
466 |
|
|
|
467 |
|
|
defineGetter(req, 'fresh', function(){
|
468 |
|
|
var method = this.method;
|
469 |
|
|
var res = this.res
|
470 |
|
|
var status = res.statusCode
|
471 |
|
|
|
472 |
|
|
// GET or HEAD for weak freshness validation only
|
473 |
|
|
if ('GET' !== method && 'HEAD' !== method) return false;
|
474 |
|
|
|
475 |
|
|
// 2xx or 304 as per rfc2616 14.26
|
476 |
|
|
if ((status >= 200 && status < 300) || 304 === status) {
|
477 |
|
|
return fresh(this.headers, {
|
478 |
|
|
'etag': res.get('ETag'),
|
479 |
|
|
'last-modified': res.get('Last-Modified')
|
480 |
|
|
})
|
481 |
|
|
}
|
482 |
|
|
|
483 |
|
|
return false;
|
484 |
|
|
});
|
485 |
|
|
|
486 |
|
|
/**
|
487 |
|
|
* Check if the request is stale, aka
|
488 |
|
|
* "Last-Modified" and / or the "ETag" for the
|
489 |
|
|
* resource has changed.
|
490 |
|
|
*
|
491 |
|
|
* @return {Boolean}
|
492 |
|
|
* @public
|
493 |
|
|
*/
|
494 |
|
|
|
495 |
|
|
defineGetter(req, 'stale', function stale(){
|
496 |
|
|
return !this.fresh;
|
497 |
|
|
});
|
498 |
|
|
|
499 |
|
|
/**
|
500 |
|
|
* Check if the request was an _XMLHttpRequest_.
|
501 |
|
|
*
|
502 |
|
|
* @return {Boolean}
|
503 |
|
|
* @public
|
504 |
|
|
*/
|
505 |
|
|
|
506 |
|
|
defineGetter(req, 'xhr', function xhr(){
|
507 |
|
|
var val = this.get('X-Requested-With') || '';
|
508 |
|
|
return val.toLowerCase() === 'xmlhttprequest';
|
509 |
|
|
});
|
510 |
|
|
|
511 |
|
|
/**
|
512 |
|
|
* Helper function for creating a getter on an object.
|
513 |
|
|
*
|
514 |
|
|
* @param {Object} obj
|
515 |
|
|
* @param {String} name
|
516 |
|
|
* @param {Function} getter
|
517 |
|
|
* @private
|
518 |
|
|
*/
|
519 |
|
|
function defineGetter(obj, name, getter) {
|
520 |
|
|
Object.defineProperty(obj, name, {
|
521 |
|
|
configurable: true,
|
522 |
|
|
enumerable: true,
|
523 |
|
|
get: getter
|
524 |
|
|
});
|
525 |
|
|
}
|