rejectInvalidRequestMiddleware() — vite Function Reference

Architecture documentation for the rejectInvalidRequestMiddleware() function in rejectInvalidRequest.ts from the vite codebase.

Function typescript ViteCore ConfigEngine called by 1

Entity Profile

ViteCore→ ConfigEngine→ rejectInvalidRequestMiddleware() — vite Function Reference

Dependency Diagram

graph TD
  0e2f0131_f3cf_8432_308e_aeb012277f8e["rejectInvalidRequestMiddleware()"]
  f8319348_d3b1_608b_8006_8e82e9a296d0["rejectInvalidRequest.ts"]
  0e2f0131_f3cf_8432_308e_aeb012277f8e -->|defined in| f8319348_d3b1_608b_8006_8e82e9a296d0
  24ecf2a1_3c09_d451_76f3_9485b4e993f8["_createServer()"]
  24ecf2a1_3c09_d451_76f3_9485b4e993f8 -->|calls| 0e2f0131_f3cf_8432_308e_aeb012277f8e
  style 0e2f0131_f3cf_8432_308e_aeb012277f8e fill:#6366f1,stroke:#818cf8,color:#fff

Relationship Graph

Source Code

packages/vite/src/node/server/middlewares/rejectInvalidRequest.ts lines 6–23

export function rejectInvalidRequestMiddleware(): Connect.NextHandleFunction {
  // Keep the named function. The name is visible in debug logs via `DEBUG=connect:dispatcher ...`
  return function viteRejectInvalidRequestMiddleware(req, res, next) {
    // HTTP spec does not allow `#` in the request-target
    // (HTTP 1.1: https://datatracker.ietf.org/doc/html/rfc9112#section-3.2)
    // (HTTP 2: https://datatracker.ietf.org/doc/html/rfc9113#section-8.3.1-2.4.1)
    // But Node.js allows those requests.
    // Our middlewares don't expect `#` to be included in `req.url`, especially the `server.fs.deny` checks.
    if (req.url?.includes('#')) {
      // HTTP 1.1 spec recommends sending 400 Bad Request
      // (https://datatracker.ietf.org/doc/html/rfc9112#section-3.2-4)
      res.writeHead(400)
      res.end()
      return
    }
    return next()
  }
}