Function requestBase

src/video-proxy-shared.ts:48–79

(req: http.IncomingMessage, logger: Logger)

const FORWARDED_HOST_IPV6_RE = /^\[[0-9a-fA-F:.]+\](:\d+)?$/;

export function requestBase(req: http.IncomingMessage, logger: Logger): string {
  // Honor x-forwarded-proto and x-forwarded-host so generated URLs survive a
  // TLS-terminating or host-rewriting proxy in front of the mock. First
  // non-empty value wins on comma-joined lists.
  const candidate = firstForwardedValue(req.headers["x-forwarded-proto"])?.toLowerCase();
  // Allowlist http/https — any other value (ws, junk header data) falls back.
  const proto = candidate === "http" || candidate === "https" ? candidate : "http";
  // Like the proto allowlist, a forwarded host that doesn't look like a bare
  // host[:port] (or a bracketed IPv6 literal) falls back to the Host header —
  // with a warn, so a misconfigured proxy isn't silently ignored.
  const fwdHost = firstForwardedValue(req.headers["x-forwarded-host"]);
  // The Host fallback gets the same host[:port] validation — a junk Host
  // (e.g. "evil.com/path") could otherwise smuggle URL structure into the
  // generated URLs. No warn: a missing/odd Host is transport-level noise,
  // unlike a misconfigured proxy's x-forwarded-host.
  const rawHost = req.headers.host;
  let host =
    rawHost !== undefined &&
    (FORWARDED_HOST_RE.test(rawHost) || FORWARDED_HOST_IPV6_RE.test(rawHost))
      ? rawHost
      : "localhost";
  if (fwdHost !== undefined) {
    if (FORWARDED_HOST_RE.test(fwdHost) || FORWARDED_HOST_IPV6_RE.test(fwdHost)) {
      host = fwdHost;
    } else {
      logger.warn(
        `x-forwarded-host value rejected, falling back to Host header: ${JSON.stringify(fwdHost.slice(0, 100))}`,
      );
    }
  }
  return `${proto}://${host}`;
}

/**
 * Query-string suffix embedding the request's testId into generated URLs