Skip to content

Commit 14aa111

Browse files
styfletargos
authored andcommitted
doc: provide alternative to url.parse() using WHATWG URL
PR-URL: #59736 Reviewed-By: Yagiz Nizipli <yagiz@nizipli.com> Reviewed-By: Rich Trott <rtrott@gmail.com> Reviewed-By: Gerhard Stöbich <deb2001-github@yahoo.de> Reviewed-By: Trivikram Kamat <trivikr.dev@gmail.com>
1 parent f941232 commit 14aa111

File tree

1 file changed

+9
-1
lines changed

1 file changed

+9
-1
lines changed

doc/api/url.md

Lines changed: 9 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1841,7 +1841,15 @@ A `URIError` is thrown if the `auth` property is present but cannot be decoded.
18411841
strings. It is prone to security issues such as [host name spoofing][]
18421842
and incorrect handling of usernames and passwords. Do not use with untrusted
18431843
input. CVEs are not issued for `url.parse()` vulnerabilities. Use the
1844-
[WHATWG URL][] API instead.
1844+
[WHATWG URL][] API instead, for example:
1845+
1846+
```js
1847+
function getURL(req) {
1848+
const proto = req.headers['x-forwarded-proto'] || 'https';
1849+
const host = req.headers['x-forwarded-host'] || req.headers.host || 'example.com';
1850+
return new URL(req.url || '/', `${proto}://${host}`);
1851+
}
1852+
```
18451853
18461854
### `url.resolve(from, to)`
18471855

0 commit comments

Comments
 (0)