Skip to content

docs: a Host carrying a slash is not refused #164

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
KyleJune merged 1 commit into from
Sep 25, 2026
Merged

docs: a Host carrying a slash is not refused #164

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
7 changes: 4 additions & 3 deletions docs/middleware.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -127,9 +127,10 @@ middleware in Hono while React Router, which matches the resolved path, ran the
`/admin` loader, so `app.use("/admin/*", requireAdmin)` would never see it. The
check compares the raw path with `URL.pathname`, so it also refuses, fail
closed, bytes the parser percent-encodes rather than resolves — raw UTF-8 such
as `/café`, `"`, `<`, `>`, `` ` ``, `{`, `}` — and a `Host` header carrying `/`,
`?` or `\`. Browsers resolve and encode such paths before sending them; only a
hand-built request is refused.
as `/café`, `"`, `<`, `>`, `` ` ``, `{`, `}` — and a `Host` header carrying `?`
or `\`. A `Host` carrying `/` is not refused: the raw and parsed paths then
agree, so both routers route the same path. Browsers resolve and encode such
paths before sending them; only a hand-built request is refused.

### Common Patterns

Expand Down
5 changes: 3 additions & 2 deletions src/server.tsx
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -59,7 +59,7 @@ function rawRequestPath(url: string): string {
* can match one route's middleware while running another route's loader. The
* raw string is compared with `URL.pathname`, so bytes the parser
* percent-encodes rather than resolves (raw UTF-8, `"`, `<`, `>`, `` ` ``, `{`,
* `}`) and a `Host` carrying `/`, `?` or `\` are flagged too, fail closed.
* `}`) and a `Host` carrying `?` or `\` are flagged too, fail closed.
*/
function isUnresolvedPath(request: Request): boolean {
return rawRequestPath(request.url) !== new URL(request.url).pathname;
Expand All @@ -79,7 +79,8 @@ function isUnresolvedPath(request: Request): boolean {
* middleware and run another route's loader. The same comparison also refuses,
* fail closed, bytes the parser percent-encodes rather than resolves — raw
* UTF-8 such as `/café`, `"`, `<`, `>`, `` ` ``, `{`, `}` — and a `Host`
* header carrying `/`, `?` or `\`. Browsers resolve and encode such paths
* header carrying `?` or `\`. A `Host` carrying `/` is not refused: the raw
* and parsed paths then agree, so both routers route the same path. Browsers resolve and encode such paths
* before sending them, so only a hand-built request sees the refusal. Responses vary by `Accept` and
* `X-Juniper-Route-Id` while retaining application cache variation. Route data
* responses and redirects sent to data requests default to `Cache-Control:
Expand Down
Loading