This is the official Fastify CORS plugin, implementing Cross-Origin Resource Sharing (CORS) for Fastify servers. It provides comprehensive configuration for all standard CORS headers, including origin (string, regex, array, boolean, or dynamic function), methods, allowed headers, exposed headers, credentials, max age, cache control, and preflight handling. The architecture is a standard Fastify plugin that registers a configurable lifecycle hook (default onRequest) and a wildcard OPTIONS route to handle preflight requests. It supports dynamic configuration via a delegator callback or promise, and per-route CORS overrides via route config. The code is well-structured, thoroughly tested, and includes a particularly well-crafted `vary.js` module for managing the Vary header with caching. Dependencies are minimal and up to date.
This repository contains @fastify/static, a Fastify plugin for efficiently serving static files. The plugin provides high-performance static file serving with features including MIME type detection, directory listing (JSON/HTML formats), pre-compressed file brokering (brotli/gzip/deflate), range requests, cache control headers, and robust path security to prevent directory traversal attacks. It follows Fastify plugin conventions and decorates reply objects with sendFile and download methods for flexible file serving. The architecture separates concerns with core logic in index.js, directory listing functionality in lib/dirList.js, and error definitions in lib/errors.js. Notable implementation details include concurrent file system operations using fastq for directory listings, sophisticated path normalization and security checks to handle various edge cases (non-canonical paths, dot-dot segments, symbolic links), and intelligent content negotiation for serving the optimal pre-compressed file variant based on client Accept-Encoding headers.
@fastify/cookie is a Fastify plugin that adds cookie handling capabilities to Fastify applications. It provides automatic parsing of incoming cookies via Fastify hooks and methods to set, clear, and sign cookies on responses. The plugin integrates with Fastify's lifecycle through decorators and hooks, supporting various hook points for cookie parsing (onRequest, preParsing, etc.). It includes robust security features like cookie signing with HMAC, key rotation support, and protection against timing attacks. The implementation follows Fastify plugin best practices and provides both high-level convenience methods and low-level utilities for direct use.