3

I was recently surprised to find that req.url (inheritied from node's http module) and req.originalUrl (a copy of req.url that is preserved from rewriting by middleware, for example) can return an absolute URL rather than a path.

This is because message.url in node's http module is simply the URL of the GET request, and apparently (if I'm readying right) a GET request can have an absolute URL and still be valid. (Edit: yes, MDN confirms my understanding here.)

So is it true that req.url and req.originalUrl are simply exact copies of the GET URL? If so, I'm really surprised that every answer on this question, including ones with hundreds of upvotes say that you should get the full URL like so:

req.protocol + '://' + req.get('host') + req.originalUrl

Given that nearly 500k people have viewed that question without making a comment or answer, it seems like I must be missing something here. But then, reading this GitHub issue, it seems that my interpretation is correct.

So I'm basically asking this question to confirm my understanding so I can write an answer/comment/edit on that linked question and hopefully help others avoid the problems that I had that result from using code like the above without handling the possibility of an absolute URL.

joe
  • 3,752
  • 1
  • 32
  • 41
  • I had a similar problem with `req.get('host')`. Depending on the device it would return the full URL with protocol and not *just* the host – Daniel_Knights Aug 22 '20 at 22:04
  • That's strange. I would have expected that express would reject requests with an invalid `Host` header. I guess they leave it up to the user, and just report exactly what they received. But it seems that the `GET` URL can actually be an absolute URL according to the spec, so in this case I'm just confused at the advice all over the internet to get the full URL by appending `req.url` to the protocol+host. Just need someone to confirm my understanding here so I can suggest some edits. – joe Aug 22 '20 at 22:39

0 Answers0