GeezerVison is showing github.com — doc: provide alternative to `url.parse()` using WHATWG URL · nodejs/node@b3eeb3b
File tree
Expand file treeCollapse file tree
Open diff view settings
Expand file treeCollapse file tree
Open diff view settings
Collapse file
Copy file name to clipboardExpand all lines: doc/api/url.md +9-1Lines changed: 9 additions & 1 deletion - Display the source diff
- Display the rich diff
| Original file line number | Diff line number | Diff line change |
|---|
@@ -1714,7 +1714,15 @@ A `URIError` is thrown if the `auth` property is present but cannot be decoded. |
1714 | 1714 | strings. It is prone to security issues such as [host name spoofing][] |
1715 | 1715 | and incorrect handling of usernames and passwords. Do not use with untrusted |
1716 | 1716 | input. CVEs are not issued for `url.parse()` vulnerabilities. Use the |
1717 | | -[WHATWG URL][] API instead. |
| 1717 | +[WHATWG URL][] API instead, for example: |
| 1718 | + |
| 1719 | +```js |
| 1720 | +function getURL(req) { |
| 1721 | + const proto = req.headers['x-forwarded-proto'] || 'https'; |
| 1722 | + const host = req.headers['x-forwarded-host'] || req.headers.host || 'example.com'; |
| 1723 | + return new URL(req.url || '/', `${proto}://${host}`); |
| 1724 | +} |
| 1725 | +``` |
1718 | 1726 |
|
1719 | 1727 | The example above assumes well-formed headers are forwarded from a reverse |
1720 | 1728 | proxy to your Node.js server. If you are not using a reverse proxy, you should |
|