Two related gaps in the HTTP module: no way to scope error handling to a route subtree or answer unmatched requests, and no safe way to build HTML responses.
Error handling & fallbacks
handleErrors(handler, child) — scoped exception handler (akka-http ExceptionHandler-style), sugar over the existing middleware Route kind; sees the original thrown error before the backend default mapping; returning null escalates.fallback(handler) — root-only Route kind wired to each backend's setNotFound hook (method-agnostic). Capability check in bind(); single-fallback guard.ServerBuilder.withErrorHandler(h) — server-wide last-resort handler wired to setErrorHandler. Requires unifying FastifyBackend so handler-thrown errors also reach it (today its per-route try/catch swallows them before setErrorHandler).- Shared
defaultErrorResponse(err) helper; exports from src/http/index.ts.
HTML / XSS utilities (src/http/Html.ts)
escapeHtml(s), SafeHtml brand, html tagged template (auto-escapes interpolations, SafeHtml verbatim, arrays recursive), rawHtml escape hatch, completeHtml(status, body) → text/html; charset=utf-8 + x-content-type-options: nosniff.- Out of scope here: sanitization of untrusted markup — tracked separately.
Notes
- Pre-1.0 BREAKING (flag in CHANGELOG):
Route/CompiledEndpoint unions widen; ServerBuilder gains a method; Fastify setErrorHandler now also receives handler errors.
- Tests: HandleErrors, Fallback (3-backend matrix), ServerErrorHandler, Html. Docs EN+DE:
http/error-handling, http/html-xss.
Two related gaps in the HTTP module: no way to scope error handling to a route subtree or answer unmatched requests, and no safe way to build HTML responses.
Error handling & fallbacks
handleErrors(handler, child)— scoped exception handler (akka-httpExceptionHandler-style), sugar over the existingmiddlewareRoute kind; sees the original thrown error before the backend default mapping; returningnullescalates.fallback(handler)— root-only Route kind wired to each backend'ssetNotFoundhook (method-agnostic). Capability check inbind(); single-fallback guard.ServerBuilder.withErrorHandler(h)— server-wide last-resort handler wired tosetErrorHandler. Requires unifying FastifyBackend so handler-thrown errors also reach it (today its per-route try/catch swallows them beforesetErrorHandler).defaultErrorResponse(err)helper; exports fromsrc/http/index.ts.HTML / XSS utilities (
src/http/Html.ts)escapeHtml(s),SafeHtmlbrand,htmltagged template (auto-escapes interpolations,SafeHtmlverbatim, arrays recursive),rawHtmlescape hatch,completeHtml(status, body)→text/html; charset=utf-8+x-content-type-options: nosniff.Notes
Route/CompiledEndpointunions widen;ServerBuildergains a method; FastifysetErrorHandlernow also receives handler errors.http/error-handling,http/html-xss.