feat(response): new setting strict status codes

History.md

@@ -1,11 +1,14 @@
 unreleased
 =========================
-* remove: 
+* remove:
   - `path-is-absolute` dependency - use `path.isAbsolute` instead
 * breaking:
-  * `res.status()` accepts only integers, and input must be greater than 99 and less than 1000
-    * will throw a `RangeError: Invalid status code: ${code}. Status code must be greater than 99 and less than 1000.` for inputs outside this range
-    * will throw a `TypeError: Invalid status code: ${code}. Status code must be an integer.` for non integer inputs
+  * By default `res.status()` accepts only integers, and input must be greater than 99 and less than 1000
+    * Will throw a `RangeError: Invalid status code: ${code}. Status code must be greater than 99 and less than 1000.` for inputs outside this range.
+    * Will throw a `TypeError: Invalid status code: ${code}. Status code must be an integer.` for non integer inputs.
+  * Added a new default setting `strict status codes`, with a default value of false.
+    * When the value of the variable `strict status codes` is set to true, `res.status()` accepts only integers, and input must be greater than 99 and less than 600.
+    * Will throw a `RangeError: Invalid status code: ${code}. Status code must be greater than 99 and less than 600 in strict status codes.`
   * deps: [email protected]
 * change:
   - `res.clearCookie` will ignore user provided `maxAge` and `expires` options

lib/application.js

@@ -99,6 +99,7 @@ app.defaultConfiguration = function defaultConfiguration() {
   this.set('query parser', 'simple')
   this.set('subdomain offset', 2);
   this.set('trust proxy', false);
+  this.set('strict status codes', false);
 
   // trust proxy inherit back-compat
   Object.defineProperty(this.settings, trustProxyDefaultSymbol, {

lib/response.js

@@ -73,6 +73,12 @@ res.status = function status(code) {
   if (!Number.isInteger(code)) {
     throw new TypeError(`Invalid status code: ${JSON.stringify(code)}. Status code must be an integer.`);
   }
+
+  // Check if the status code is outside of Node's valid range
+  if (this.app.get('strict status codes') === true && (code < 100 || code > 599)) {
+    throw new RangeError(`Invalid status code: ${JSON.stringify(code)}. Status code must be greater than 99 and less than 600 in strict status codes.`);
+  }
+
   // Check if the status code is outside of Node's valid range
   if (code < 100 || code > 999) {
     throw new RangeError(`Invalid status code: ${JSON.stringify(code)}. Status code must be greater than 99 and less than 1000.`);

test/res.status.js

@@ -129,6 +129,20 @@ describe('res', function () {
           .expect(500, /Invalid status code/, done);
       });
 
+      it('should raise error for status code above 599 with strict status code', function (done) {
+        var app = express();
+
+        app.set('strict status codes', true);
+
+        app.use(function (req, res) {
+          res.status(600).end();
+        });
+
+        request(app)
+          .get('/')
+          .expect(500, /Status code must be greater than 99 and less than 600 in strict status codes./, done);
+      });
+
       it('should raise error for status code above 999', function (done) {
         var app = express();