Method setupMiddlewares

lib/Server.js:1959–2518

* @private * @returns {Promise }

()

   * @returns {Promise<void>}
   */
  async setupMiddlewares() {
    if (this.compiler === undefined) return;
    /**
     * @type {Middleware[]}
     */
    let middlewares = [];

    // Register setup host header check for security
    middlewares.push({
      name: "host-header-check",
      /**
       * @param {Request} req request
       * @param {Response} res response
       * @param {NextFunction} next next function
       * @returns {void}
       */
      middleware: (req, res, next) => {
        const headers =
          /** @type {{ [key: string]: string | undefined }} */
          (req.headers);
        const headerName = headers[":authority"] ? ":authority" : "host";

        if (this.isValidHost(headers, headerName)) {
          next();
          return;
        }

        res.statusCode = 403;
        res.end("Invalid Host header");
      },
    });

    // Register setup cross origin request check for security
    middlewares.push({
      name: "cross-origin-header-check",
      /**
       * @param {Request} req request
       * @param {Response} res response
       * @param {NextFunction} next next function
       * @returns {void}
       */
      middleware: (req, res, next) => {
        const headers =
          /** @type {{ [key: string]: string | undefined }} */
          (req.headers);
        const headerName = headers[":authority"] ? ":authority" : "host";

        if (this.isValidHost(headers, headerName, false)) {
          next();
          return;
        }

        if (
          headers["sec-fetch-mode"] === "no-cors" &&
          headers["sec-fetch-site"] === "cross-site"
        ) {
          res.statusCode = 403;
          res.end("Cross-Origin request blocked");