3 * Copyright(c) 2009-2013 TJ Holowaychuk
4 * Copyright(c) 2014-2015 Douglas Christopher Wilson
11 * Module dependencies.
15 var Buffer = require('safe-buffer').Buffer
16 var contentDisposition = require('content-disposition');
17 var deprecate = require('depd')('express');
18 var encodeUrl = require('encodeurl');
19 var escapeHtml = require('escape-html');
20 var http = require('http');
21 var isAbsolute = require('./utils').isAbsolute;
22 var onFinished = require('on-finished');
23 var path = require('path');
24 var statuses = require('statuses')
25 var merge = require('utils-merge');
26 var sign = require('cookie-signature').sign;
27 var normalizeType = require('./utils').normalizeType;
28 var normalizeTypes = require('./utils').normalizeTypes;
29 var setCharset = require('./utils').setCharset;
30 var cookie = require('cookie');
31 var send = require('send');
32 var extname = path.extname;
34 var resolve = path.resolve;
35 var vary = require('vary');
42 var res = Object.create(http.ServerResponse.prototype)
56 var charsetRegExp = /;\s*charset\s*=/;
61 * @param {Number} code
62 * @return {ServerResponse}
66 res.status = function status(code) {
67 this.statusCode = code;
72 * Set Link header field with the given `links`.
77 * next: 'http://api.example.com/users?page=2',
78 * last: 'http://api.example.com/users?page=5'
81 * @param {Object} links
82 * @return {ServerResponse}
86 res.links = function(links){
87 var link = this.get('Link') || '';
88 if (link) link += ', ';
89 return this.set('Link', link + Object.keys(links).map(function(rel){
90 return '<' + links[rel] + '>; rel="' + rel + '"';
99 * res.send(Buffer.from('wahoo'));
100 * res.send({ some: 'json' });
101 * res.send('<p>some html</p>');
103 * @param {string|number|boolean|object|Buffer} body
107 res.send = function send(body) {
116 // allow status / body
117 if (arguments.length === 2) {
118 // res.send(body, status) backwards compat
119 if (typeof arguments[0] !== 'number' && typeof arguments[1] === 'number') {
120 deprecate('res.send(body, status): Use res.status(status).send(body) instead');
121 this.statusCode = arguments[1];
123 deprecate('res.send(status, body): Use res.status(status).send(body) instead');
124 this.statusCode = arguments[0];
125 chunk = arguments[1];
129 // disambiguate res.send(status) and res.send(status, num)
130 if (typeof chunk === 'number' && arguments.length === 1) {
131 // res.send(status) will set status message as text string
132 if (!this.get('Content-Type')) {
136 deprecate('res.send(status): Use res.sendStatus(status) instead');
137 this.statusCode = chunk;
138 chunk = statuses[chunk]
141 switch (typeof chunk) {
142 // string defaulting to html
144 if (!this.get('Content-Type')) {
151 if (chunk === null) {
153 } else if (Buffer.isBuffer(chunk)) {
154 if (!this.get('Content-Type')) {
158 return this.json(chunk);
163 // write strings in utf-8
164 if (typeof chunk === 'string') {
166 type = this.get('Content-Type');
168 // reflect this in content-type
169 if (typeof type === 'string') {
170 this.set('Content-Type', setCharset(type, 'utf-8'));
174 // determine if ETag should be generated
175 var etagFn = app.get('etag fn')
176 var generateETag = !this.get('ETag') && typeof etagFn === 'function'
178 // populate Content-Length
180 if (chunk !== undefined) {
181 if (Buffer.isBuffer(chunk)) {
182 // get length of Buffer
184 } else if (!generateETag && chunk.length < 1000) {
185 // just calculate length when no ETag + small chunk
186 len = Buffer.byteLength(chunk, encoding)
188 // convert chunk to Buffer and calculate
189 chunk = Buffer.from(chunk, encoding)
190 encoding = undefined;
194 this.set('Content-Length', len);
199 if (generateETag && len !== undefined) {
200 if ((etag = etagFn(chunk, encoding))) {
201 this.set('ETag', etag);
206 if (req.fresh) this.statusCode = 304;
208 // strip irrelevant headers
209 if (204 === this.statusCode || 304 === this.statusCode) {
210 this.removeHeader('Content-Type');
211 this.removeHeader('Content-Length');
212 this.removeHeader('Transfer-Encoding');
216 if (req.method === 'HEAD') {
217 // skip body for HEAD
221 this.end(chunk, encoding);
228 * Send JSON response.
233 * res.json({ user: 'tj' });
235 * @param {string|number|boolean|object} obj
239 res.json = function json(obj) {
242 // allow status / body
243 if (arguments.length === 2) {
244 // res.json(body, status) backwards compat
245 if (typeof arguments[1] === 'number') {
246 deprecate('res.json(obj, status): Use res.status(status).json(obj) instead');
247 this.statusCode = arguments[1];
249 deprecate('res.json(status, obj): Use res.status(status).json(obj) instead');
250 this.statusCode = arguments[0];
257 var escape = app.get('json escape')
258 var replacer = app.get('json replacer');
259 var spaces = app.get('json spaces');
260 var body = stringify(val, replacer, spaces, escape)
263 if (!this.get('Content-Type')) {
264 this.set('Content-Type', 'application/json');
267 return this.send(body);
271 * Send JSON response with JSONP callback support.
276 * res.jsonp({ user: 'tj' });
278 * @param {string|number|boolean|object} obj
282 res.jsonp = function jsonp(obj) {
285 // allow status / body
286 if (arguments.length === 2) {
287 // res.json(body, status) backwards compat
288 if (typeof arguments[1] === 'number') {
289 deprecate('res.jsonp(obj, status): Use res.status(status).json(obj) instead');
290 this.statusCode = arguments[1];
292 deprecate('res.jsonp(status, obj): Use res.status(status).jsonp(obj) instead');
293 this.statusCode = arguments[0];
300 var escape = app.get('json escape')
301 var replacer = app.get('json replacer');
302 var spaces = app.get('json spaces');
303 var body = stringify(val, replacer, spaces, escape)
304 var callback = this.req.query[app.get('jsonp callback name')];
307 if (!this.get('Content-Type')) {
308 this.set('X-Content-Type-Options', 'nosniff');
309 this.set('Content-Type', 'application/json');
313 if (Array.isArray(callback)) {
314 callback = callback[0];
318 if (typeof callback === 'string' && callback.length !== 0) {
319 this.set('X-Content-Type-Options', 'nosniff');
320 this.set('Content-Type', 'text/javascript');
322 // restrict callback charset
323 callback = callback.replace(/[^\[\]\w$.]/g, '');
325 // replace chars not allowed in JavaScript that are in JSON
327 .replace(/\u2028/g, '\\u2028')
328 .replace(/\u2029/g, '\\u2029');
330 // the /**/ is a specific security mitigation for "Rosetta Flash JSONP abuse"
331 // the typeof check is just to reduce client error noise
332 body = '/**/ typeof ' + callback + ' === \'function\' && ' + callback + '(' + body + ');';
335 return this.send(body);
339 * Send given HTTP status code.
341 * Sets the response status to `statusCode` and the body of the
342 * response to the standard description from node's http.STATUS_CODES
343 * or the statusCode number if no description.
347 * res.sendStatus(200);
349 * @param {number} statusCode
353 res.sendStatus = function sendStatus(statusCode) {
354 var body = statuses[statusCode] || String(statusCode)
356 this.statusCode = statusCode;
359 return this.send(body);
363 * Transfer the file at the given `path`.
365 * Automatically sets the _Content-Type_ response header field.
366 * The callback `callback(err)` is invoked when the transfer is complete
367 * or when an error occurs. Be sure to check `res.sentHeader`
368 * if you wish to attempt responding, as the header and some data
369 * may have already been transferred.
373 * - `maxAge` defaulting to 0 (can be string converted by `ms`)
374 * - `root` root directory for relative filenames
375 * - `headers` object of headers to serve with file
376 * - `dotfiles` serve dotfiles, defaulting to false; can be `"allow"` to send them
378 * Other options are passed along to `send`.
382 * The following example illustrates how `res.sendFile()` may
383 * be used as an alternative for the `static()` middleware for
384 * dynamic situations. The code backing `res.sendFile()` is actually
385 * the same code, so HTTP cache support etc is identical.
387 * app.get('/user/:uid/photos/:file', function(req, res){
388 * var uid = req.params.uid
389 * , file = req.params.file;
391 * req.user.mayViewFilesFrom(uid, function(yes){
393 * res.sendFile('/uploads/' + uid + '/' + file);
395 * res.send(403, 'Sorry! you cant see that.');
403 res.sendFile = function sendFile(path, options, callback) {
408 var opts = options || {};
411 throw new TypeError('path argument is required to res.sendFile');
414 // support function as second arg
415 if (typeof options === 'function') {
420 if (!opts.root && !isAbsolute(path)) {
421 throw new TypeError('path must be absolute or specify root to res.sendFile');
424 // create file stream
425 var pathname = encodeURI(path);
426 var file = send(req, pathname, opts);
429 sendfile(res, file, opts, function (err) {
430 if (done) return done(err);
431 if (err && err.code === 'EISDIR') return next();
433 // next() all but write errors
434 if (err && err.code !== 'ECONNABORTED' && err.syscall !== 'write') {
441 * Transfer the file at the given `path`.
443 * Automatically sets the _Content-Type_ response header field.
444 * The callback `callback(err)` is invoked when the transfer is complete
445 * or when an error occurs. Be sure to check `res.sentHeader`
446 * if you wish to attempt responding, as the header and some data
447 * may have already been transferred.
451 * - `maxAge` defaulting to 0 (can be string converted by `ms`)
452 * - `root` root directory for relative filenames
453 * - `headers` object of headers to serve with file
454 * - `dotfiles` serve dotfiles, defaulting to false; can be `"allow"` to send them
456 * Other options are passed along to `send`.
460 * The following example illustrates how `res.sendfile()` may
461 * be used as an alternative for the `static()` middleware for
462 * dynamic situations. The code backing `res.sendfile()` is actually
463 * the same code, so HTTP cache support etc is identical.
465 * app.get('/user/:uid/photos/:file', function(req, res){
466 * var uid = req.params.uid
467 * , file = req.params.file;
469 * req.user.mayViewFilesFrom(uid, function(yes){
471 * res.sendfile('/uploads/' + uid + '/' + file);
473 * res.send(403, 'Sorry! you cant see that.');
481 res.sendfile = function (path, options, callback) {
486 var opts = options || {};
488 // support function as second arg
489 if (typeof options === 'function') {
494 // create file stream
495 var file = send(req, path, opts);
498 sendfile(res, file, opts, function (err) {
499 if (done) return done(err);
500 if (err && err.code === 'EISDIR') return next();
502 // next() all but write errors
503 if (err && err.code !== 'ECONNABORTED' && err.syscall !== 'write') {
509 res.sendfile = deprecate.function(res.sendfile,
510 'res.sendfile: Use res.sendFile instead');
513 * Transfer the file at the given `path` as an attachment.
515 * Optionally providing an alternate attachment `filename`,
516 * and optional callback `callback(err)`. The callback is invoked
517 * when the data transfer is complete, or when an error has
518 * ocurred. Be sure to check `res.headersSent` if you plan to respond.
520 * Optionally providing an `options` object to use with `res.sendFile()`.
521 * This function will set the `Content-Disposition` header, overriding
522 * any `Content-Disposition` header passed as header options in order
523 * to set the attachment and filename.
525 * This method uses `res.sendFile()`.
530 res.download = function download (path, filename, options, callback) {
533 var opts = options || null
535 // support function as second or third arg
536 if (typeof filename === 'function') {
540 } else if (typeof options === 'function') {
545 // set Content-Disposition when file is sent
547 'Content-Disposition': contentDisposition(name || path)
550 // merge user-provided headers
551 if (opts && opts.headers) {
552 var keys = Object.keys(opts.headers)
553 for (var i = 0; i < keys.length; i++) {
555 if (key.toLowerCase() !== 'content-disposition') {
556 headers[key] = opts.headers[key]
561 // merge user-provided options
562 opts = Object.create(opts)
563 opts.headers = headers
565 // Resolve the full path for sendFile
566 var fullPath = resolve(path);
569 return this.sendFile(fullPath, opts, done)
573 * Set _Content-Type_ response header with `type` through `mime.lookup()`
574 * when it does not contain "/", or set the Content-Type to `type` otherwise.
581 * res.type('application/json');
584 * @param {String} type
585 * @return {ServerResponse} for chaining
590 res.type = function contentType(type) {
591 var ct = type.indexOf('/') === -1
595 return this.set('Content-Type', ct);
599 * Respond to the Acceptable formats using an `obj`
600 * of mime-type callbacks.
602 * This method uses `req.accepted`, an array of
603 * acceptable types ordered by their quality values.
604 * When "Accept" is not present the _first_ callback
605 * is invoked, otherwise the first match is used. When
606 * no match is performed the server responds with
607 * 406 "Not Acceptable".
609 * Content-Type is set for you, however if you choose
610 * you may alter this within the callback using `res.type()`
611 * or `res.set('Content-Type', ...)`.
614 * 'text/plain': function(){
618 * 'text/html': function(){
619 * res.send('<p>hey</p>');
622 * 'appliation/json': function(){
623 * res.send({ message: 'hey' });
627 * In addition to canonicalized MIME types you may
628 * also use extnames mapped to these types:
636 * res.send('<p>hey</p>');
640 * res.send({ message: 'hey' });
644 * By default Express passes an `Error`
645 * with a `.status` of 406 to `next(err)`
646 * if a match is not made. If you provide
647 * a `.default` callback it will be invoked
650 * @param {Object} obj
651 * @return {ServerResponse} for chaining
655 res.format = function(obj){
659 var fn = obj.default;
660 if (fn) delete obj.default;
661 var keys = Object.keys(obj);
663 var key = keys.length > 0
670 this.set('Content-Type', normalizeType(key).value);
671 obj[key](req, this, next);
675 var err = new Error('Not Acceptable');
676 err.status = err.statusCode = 406;
677 err.types = normalizeTypes(keys).map(function(o){ return o.value });
685 * Set _Content-Disposition_ header to _attachment_ with optional `filename`.
687 * @param {String} filename
688 * @return {ServerResponse}
692 res.attachment = function attachment(filename) {
694 this.type(extname(filename));
697 this.set('Content-Disposition', contentDisposition(filename));
703 * Append additional header `field` with value `val`.
707 * res.append('Link', ['<http://localhost/>', '<http://localhost:3000/>']);
708 * res.append('Set-Cookie', 'foo=bar; Path=/; HttpOnly');
709 * res.append('Warning', '199 Miscellaneous warning');
711 * @param {String} field
712 * @param {String|Array} val
713 * @return {ServerResponse} for chaining
717 res.append = function append(field, val) {
718 var prev = this.get(field);
722 // concat the new and prev vals
723 value = Array.isArray(prev) ? prev.concat(val)
724 : Array.isArray(val) ? [prev].concat(val)
728 return this.set(field, value);
732 * Set header `field` to `val`, or pass
733 * an object of header fields.
737 * res.set('Foo', ['bar', 'baz']);
738 * res.set('Accept', 'application/json');
739 * res.set({ Accept: 'text/plain', 'X-API-Key': 'tobi' });
741 * Aliased as `res.header()`.
743 * @param {String|Object} field
744 * @param {String|Array} val
745 * @return {ServerResponse} for chaining
750 res.header = function header(field, val) {
751 if (arguments.length === 2) {
752 var value = Array.isArray(val)
756 // add charset to content-type
757 if (field.toLowerCase() === 'content-type') {
758 if (Array.isArray(value)) {
759 throw new TypeError('Content-Type cannot be set to an Array');
761 if (!charsetRegExp.test(value)) {
762 var charset = mime.charsets.lookup(value.split(';')[0]);
763 if (charset) value += '; charset=' + charset.toLowerCase();
767 this.setHeader(field, value);
769 for (var key in field) {
770 this.set(key, field[key]);
777 * Get value for header `field`.
779 * @param {String} field
784 res.get = function(field){
785 return this.getHeader(field);
789 * Clear cookie `name`.
791 * @param {String} name
792 * @param {Object} [options]
793 * @return {ServerResponse} for chaining
797 res.clearCookie = function clearCookie(name, options) {
798 var opts = merge({ expires: new Date(1), path: '/' }, options);
800 return this.cookie(name, '', opts);
804 * Set cookie `name` to `value`, with the given `options`.
808 * - `maxAge` max-age in milliseconds, converted to `expires`
809 * - `signed` sign the cookie
810 * - `path` defaults to "/"
814 * // "Remember Me" for 15 minutes
815 * res.cookie('rememberme', '1', { expires: new Date(Date.now() + 900000), httpOnly: true });
818 * res.cookie('rememberme', '1', { maxAge: 900000, httpOnly: true })
820 * @param {String} name
821 * @param {String|Object} value
822 * @param {Object} [options]
823 * @return {ServerResponse} for chaining
827 res.cookie = function (name, value, options) {
828 var opts = merge({}, options);
829 var secret = this.req.secret;
830 var signed = opts.signed;
832 if (signed && !secret) {
833 throw new Error('cookieParser("secret") required for signed cookies');
836 var val = typeof value === 'object'
837 ? 'j:' + JSON.stringify(value)
841 val = 's:' + sign(val, secret);
844 if ('maxAge' in opts) {
845 opts.expires = new Date(Date.now() + opts.maxAge);
849 if (opts.path == null) {
853 this.append('Set-Cookie', cookie.serialize(name, String(val), opts));
859 * Set the location header to `url`.
861 * The given `url` can also be "back", which redirects
862 * to the _Referrer_ or _Referer_ headers or "/".
866 * res.location('/foo/bar').;
867 * res.location('http://example.com');
868 * res.location('../login');
870 * @param {String} url
871 * @return {ServerResponse} for chaining
875 res.location = function location(url) {
878 // "back" is an alias for the referrer
879 if (url === 'back') {
880 loc = this.req.get('Referrer') || '/';
884 return this.set('Location', encodeUrl(loc));
888 * Redirect to the given `url` with optional response `status`
891 * The resulting `url` is determined by `res.location()`, so
892 * it will play nicely with mounted apps, relative paths,
897 * res.redirect('/foo/bar');
898 * res.redirect('http://example.com');
899 * res.redirect(301, 'http://example.com');
900 * res.redirect('../login'); // /blog/post/1 -> /blog/login
905 res.redirect = function redirect(url) {
910 // allow status / url
911 if (arguments.length === 2) {
912 if (typeof arguments[0] === 'number') {
913 status = arguments[0];
914 address = arguments[1];
916 deprecate('res.redirect(url, status): Use res.redirect(status, url) instead');
917 status = arguments[1];
921 // Set location header
922 address = this.location(address).get('Location');
924 // Support text/{plain,html} by default
927 body = statuses[status] + '. Redirecting to ' + address
931 var u = escapeHtml(address);
932 body = '<p>' + statuses[status] + '. Redirecting to <a href="' + u + '">' + u + '</a></p>'
941 this.statusCode = status;
942 this.set('Content-Length', Buffer.byteLength(body));
944 if (this.req.method === 'HEAD') {
952 * Add `field` to Vary. If already present in the Vary set, then
953 * this call is simply ignored.
955 * @param {Array|String} field
956 * @return {ServerResponse} for chaining
960 res.vary = function(field){
961 // checks for back-compat
962 if (!field || (Array.isArray(field) && !field.length)) {
963 deprecate('res.vary(): Provide a field name');
973 * Render `view` with the given `options` and optional callback `fn`.
974 * When a callback function is given a response will _not_ be made
975 * automatically, otherwise a response of _200_ and _text/html_ is given.
979 * - `cache` boolean hinting to the engine it should cache
980 * - `filename` filename of the view being rendered
985 res.render = function render(view, options, callback) {
986 var app = this.req.app;
988 var opts = options || {};
992 // support callback function as second arg
993 if (typeof options === 'function') {
999 opts._locals = self.locals;
1001 // default callback to respond
1002 done = done || function (err, str) {
1003 if (err) return req.next(err);
1008 app.render(view, opts, done);
1011 // pipe the send file stream
1012 function sendfile(res, file, options, callback) {
1017 function onaborted() {
1021 var err = new Error('Request aborted');
1022 err.code = 'ECONNABORTED';
1027 function ondirectory() {
1031 var err = new Error('EISDIR, read');
1032 err.code = 'EISDIR';
1037 function onerror(err) {
1056 function onfinish(err) {
1057 if (err && err.code === 'ECONNRESET') return onaborted();
1058 if (err) return onerror(err);
1061 setImmediate(function () {
1062 if (streaming !== false && !done) {
1074 function onstream() {
1078 file.on('directory', ondirectory);
1079 file.on('end', onend);
1080 file.on('error', onerror);
1081 file.on('file', onfile);
1082 file.on('stream', onstream);
1083 onFinished(res, onfinish);
1085 if (options.headers) {
1086 // set headers on successful transfer
1087 file.on('headers', function headers(res) {
1088 var obj = options.headers;
1089 var keys = Object.keys(obj);
1091 for (var i = 0; i < keys.length; i++) {
1093 res.setHeader(k, obj[k]);
1103 * Stringify JSON, like JSON.stringify, but v8 optimized, with the
1104 * ability to escape characters that can trigger HTML sniffing.
1107 * @param {function} replaces
1108 * @param {number} spaces
1109 * @param {boolean} escape
1114 function stringify (value, replacer, spaces, escape) {
1115 // v8 checks arguments.length for optimizing simple call
1116 // https://bugs.chromium.org/p/v8/issues/detail?id=4730
1117 var json = replacer || spaces
1118 ? JSON.stringify(value, replacer, spaces)
1119 : JSON.stringify(value);
1122 json = json.replace(/[<>&]/g, function (c) {
1123 switch (c.charCodeAt(0)) {