feat: update how request.url is derived

packages/remix-fastify/__tests__/server.test.ts

@@ -110,7 +110,7 @@
 
         let response = await app.inject("/foo/bar");
 
         expect(response.body).toBe("URL: /foo/bar");
         expect(response.statusCode).toBe(200);
       });
 
@@ -123,7 +123,7 @@
 
         let response = await app.inject("//");
 
         expect(response.statusCode).toBe(200);
         expect(response.body).toBe("URL: //");
       });
 
@@ -136,7 +136,7 @@
 
         let response = await app.inject("//foo//bar");
 
         expect(response.statusCode).toBe(200);
         expect(response.body).toBe("URL: //foo//bar");
       });
 
@@ -149,7 +149,7 @@
 
         let response = await app.inject("/");
 
         expect(response.statusCode).toBe(200);
       });
 
       // https://github.com/node-fetch/node-fetch/blob/4ae35388b078bddda238277142bf091898ce6fda/test/response.js#L142-L148
@@ -163,7 +163,7 @@
         let app = createApp();
         let response = await app.inject("/");
 
         expect(response.statusCode).toBe(200);
         expect(response.body).toBe("hello world");
       });
 
@@ -175,7 +175,7 @@
         let app = createApp();
         let response = await app.inject("/");
 
         expect(response.statusCode).toBe(204);
       });
 
       it(`[${name}] sets headers`, async () => {
@@ -199,7 +199,7 @@
         let app = createApp();
         let response = await app.inject("/");
 
         expect(response.headers["x-time-of-year"]).toBe("most wonderful");
         expect(response.headers["set-cookie"]).toEqual([
           "first=one; Expires=0; Path=/; HttpOnly; Secure; SameSite=Lax",
           "second=two; MaxAge=1209600; Path=/; HttpOnly; Secure; SameSite=Lax",
@@ -275,6 +275,30 @@
       expect(request.headers.get("host")).toBe("localhost:3000");
     });
   });
+
+  it("validates parsed port", async () => {
+     let fastifyRequest = createRequest({
+       url: "/foo/bar",
+       method: "GET",
+       protocol: "http",
+       hostname: "localhost",
+       headers: {
+         "Cache-Control": "max-age=300, s-maxage=3600",
+         Host: "localhost:3000",
+         "x-forwarded-host": ":/spoofed"
+       },
+     });
+     let fastifyResponse = createResponse();
+
+     let remixRequest = createRemixRequest(fastifyRequest, fastifyResponse);
+
+     expect(remixRequest.method).toBe("GET");
+     expect(remixRequest.headers.get("cache-control")).toBe(
+       "max-age=300, s-maxage=3600"
+     );
+     expect(remixRequest.headers.get("host")).toBe("localhost:3000");
+     expect(remixRequest.url).toBe("http://localhost:3000/foo/bar");
+   });
 }
 
 runTests("remix", {

packages/remix-fastify/src/shared.ts

@@ -65,10 +65,23 @@
 export function getUrl<Server extends HttpServer>(
   request: FastifyRequest<RouteGenericInterface, Server>,
 ): string {
-  let origin = `${request.protocol}://${request.host}`;
-  // Use `request.originalUrl` so Remix and React Router are aware of the full path
-  let url = `${origin}${request.originalUrl}`;
-  return url;
+  // req.hostname doesn't include port information so grab that from
+  // `X-Forwarded-Host` or `Host`
+  let [, hostnamePortStr] = req.get("X-Forwarded-Host")?.split(":") ?? [];
+  let [, hostPortStr] = req.get("host")?.split(":") ?? [];
+  let hostnamePort = Number.parseInt(hostnamePortStr, 10);
+  let hostPort = Number.parseInt(hostPortStr, 10);
+  let port = Number.isSafeInteger(hostnamePort)
+    ? hostnamePort
+    : Number.isSafeInteger(hostPort)
+    ? hostPort
+    : "";
+
+  // Use req.hostname here as it respects the "trust proxy" setting
+  let resolvedHost = `${req.hostname}${port ? `:${port}` : ""}`;
+  // Use `req.originalUrl` so Remix is aware of the full path
+  let url = new URL(req.originalUrl, `${req.protocol}://${resolvedHost}`);
+  return url.toString()
 }
 
 export function createRequest<Server extends HttpServer>(