Skip to content

Conversation

@timokoessler
Copy link
Member

@timokoessler timokoessler commented Oct 30, 2025

We always want to use the full absolute URL including the host and different formats depending on the framework.
We also want to respect proxy headers if the proxy is trusted.

  • node:http Server ✅
  • node:http2 Server ✅
  • Express ✅
  • Hono ✅
  • Fastify ✅
  • Koa ✅
  • Hapi ✅
  • Restify ✅

We also need to add the path to the context!! ✅

Summary by Aikido

Security Issues: 0 🔍 Quality Issues: 13 Resolved Issues: 0

🚀 New Features

  • Added helper getRawRequestPath to extract path from raw URLs.

⚡ Enhancements

  • Normalized URL handling across frameworks and added urlPath field.
  • Replaced framework-specific URL assembly with centralized getRequestUrl usage.
  • Updated tests to expect absolute URLs and respect forwarded host.

🔧 Refactors

  • Added urlPath to SOURCES and propagated through Context and runtime.

More info

@codecov
Copy link

codecov bot commented Oct 31, 2025

@timokoessler timokoessler marked this pull request as ready for review October 31, 2025 16:41
timokoessler and others added 2 commits November 6, 2025 12:46
…url-handling

* 'main' of github.com:AikidoSec/node-RASP: (403 commits)
  Add length check
  Format code
  Disable Prisma instrumentation if event-based logging is used
  Add failing test for Prisma usage with event logging enabled
  Add comments for source types
  Format code
  Add some more cases
  Add another test case
  Assume CJS by default for injection detection
  Fix Network.contains() bug
  Create a method on IPMatcher
  Reduce diff
  Simplify isPrivateIP
  Use atomic assignments
  Use IPMatcher.add() instead of constructor
  Use addIPv4MappedAddresses for imds and isPrivateIP
  Remove bracket format from comment
  Add some spacing
  Be more explicit
  Add some spacing
  ...
The agent is re-used for all tests, so it sees the requests from other
test cases.
Error: Failed to build: [baseline-browser-mapping] The data in this module is over two months old.  To ensure
  accurate Baseline data, please update: `npm i baseline-browser-mapping@latest -D`
@timokoessler
Copy link
Member Author

@hansott your changes look good to me, thanks!

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants