$ show vemetric/favicon-api
This is a favicon API service built with TypeScript, Hono, and Bun that fetches and serves website favicons. The application provides a single HTTP endpoint that accepts a domain parameter, discovers favicons from multiple sources (HTML link tags, web manifest, common locations), optionally falls back to Google's favicon API, processes images (resize/format conversion), and returns either the image or JSON metadata. It's designed to be stateless and deployed behind a caching layer (CDN or reverse proxy) for production use. The codebase demonstrates strong modular architecture with clear separation of concerns, proper error handling, security features like SSRF protection, and comprehensive test coverage.
The LLM identified 4 files worth highlighting for reuse:
Provides utilities for composing request-scoped and per-operation abort signals with timeouts. Demonstrates proper use of AbortController API for cancellation and timeout handling in asynchronous operations. The module is completely self-contained with no internal dependencies, making it easily extractable for use in any TypeScript/JavaScript project requiring robust async operation management.
Detects image formats from buffer magic numbers and content. Implements comprehensive format detection for PNG, JPEG, GIF, WebP, SVG, BMP, ICO, and AVIF formats with proper fallback handling. The module has zero dependencies beyond standard Buffer operations, making it highly portable for any project needing to identify image types from binary data.
Generates proper HTTP cache control headers for different response types (success, fallback, error). Implements best practices for CDN and browser caching with ETag, Last-Modified, and Vary headers. The module depends only on a simple configuration interface, making it easily adaptable for use in any web service requiring proper HTTP caching implementation.
Provides input validation and SSRF protection using Zod schema. Includes custom URL validation with protection against private IP access and proper error messaging. The module demonstrates strong security practices by implementing SSRF protection that checks for localhost, private IP ranges, and link-local addresses, making it suitable for extraction into any project needing secure URL validation.