Skip to content

Conversation

@timokoessler
Copy link
Member

@timokoessler timokoessler commented Oct 30, 2025

We always want to use the full absolute URL including the host and different formats depending on the framework.
We also want to respect proxy headers if the proxy is trusted.

  • node:http Server ✅
  • node:http2 Server ✅
  • Express ✅
  • Hono ✅
  • Fastify ✅
  • Koa ✅
  • Hapi ✅
  • Restify ✅

We also need to add the path to the context!! ✅

@codecov
Copy link

codecov bot commented Oct 31, 2025

@timokoessler timokoessler marked this pull request as ready for review October 31, 2025 16:41
}),
body: req.payload,
url: req.url.toString(),
url: req.raw?.req ? getRequestUrl(req.raw?.req) : partialUrl,
Copy link

@aikido-pr-checks aikido-pr-checks bot Nov 6, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Changed computation of exported Context.url (now may return a different absolute form), which can break clients expecting the previous req.url.toString() value.

Details

✨ AI Reasoning
​​1) The code constructs a Context object from an incoming Hapi Request; the PR changes how the url field is computed (now using getRequestUrl(req.raw?.req) when available) and adds a new urlPath field.
​2) This alters the semantic value of the exported context.url property (previously always req.url.toString()), which can change downstream behavior for any consumers relying on the old absolute/relative form.
​3) Adding urlPath is additive and safe, but changing the existing url value is a breaking contract for clients that expect the previous format.

🔧 How do I fix it?
Support both old and new parameter names during transition periods. Add new optional parameters with defaults. Keep existing response fields while adding new ones. Focus on backwards compatibility.

More info - Comment @AikidoSec feedback: [FEEDBACK] to get better review comments in the future.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants