パッケージの詳細

serve-static

expressjs169.3mMIT2.2.0

Serve static files

readme

serve-static

NPM Version NPM Downloads CI Test Coverage

Install

This is a Node.js module available through the npm registry. Installation is done using the npm install command:

$ npm install serve-static

API

var serveStatic = require('serve-static')

serveStatic(root, options)

Create a new middleware function to serve files from within a given root directory. The file to serve will be determined by combining req.url with the provided root directory. When a file is not found, instead of sending a 404 response, this module will instead call next() to move on to the next middleware, allowing for stacking and fall-backs.

Options

acceptRanges

Enable or disable accepting ranged requests, defaults to true. Disabling this will not send Accept-Ranges and ignore the contents of the Range request header.

cacheControl

Enable or disable setting Cache-Control response header, defaults to true. Disabling this will ignore the immutable and maxAge options.

dotfiles

Set how "dotfiles" are treated when encountered. A dotfile is a file or directory that begins with a dot ("."). Note this check is done on the path itself without checking if the path actually exists on the disk. If root is specified, only the dotfiles above the root are checked (i.e. the root itself can be within a dotfile when set to "deny").

  • 'allow' No special treatment for dotfiles.
  • 'deny' Deny a request for a dotfile and 403/next().
  • 'ignore' Pretend like the dotfile does not exist and 404/next().

The default value is 'ignore'.

etag

Enable or disable etag generation, defaults to true.

extensions

Set file extension fallbacks. When set, if a file is not found, the given extensions will be added to the file name and search for. The first that exists will be served. Example: ['html', 'htm'].

The default value is false.

fallthrough

Set the middleware to have client errors fall-through as just unhandled requests, otherwise forward a client error. The difference is that client errors like a bad request or a request to a non-existent file will cause this middleware to simply next() to your next middleware when this value is true. When this value is false, these errors (even 404s), will invoke next(err).

Typically true is desired such that multiple physical directories can be mapped to the same web address or for routes to fill in non-existent files.

The value false can be used if this middleware is mounted at a path that is designed to be strictly a single file system directory, which allows for short-circuiting 404s for less overhead. This middleware will also reply to all methods.

The default value is true.

immutable

Enable or disable the immutable directive in the Cache-Control response header, defaults to false. If set to true, the maxAge option should also be specified to enable caching. The immutable directive will prevent supported clients from making conditional requests during the life of the maxAge option to check if the file has changed.

index

By default this module will send "index.html" files in response to a request on a directory. To disable this set false or to supply a new index pass a string or an array in preferred order.

lastModified

Enable or disable Last-Modified header, defaults to true. Uses the file system's last modified value.

maxAge

Provide a max-age in milliseconds for http caching, defaults to 0. This can also be a string accepted by the ms module.

redirect

Redirect to trailing "/" when the pathname is a dir. Defaults to true.

setHeaders

Function to set custom headers on response. Alterations to the headers need to occur synchronously. The function is called as fn(res, path, stat), where the arguments are:

  • res the response object
  • path the file path that is being sent
  • stat the stat object of the file that is being sent

Examples

Serve files with vanilla node.js http server

var finalhandler = require('finalhandler')
var http = require('http')
var serveStatic = require('serve-static')

// Serve up public/ftp folder
var serve = serveStatic('public/ftp', { index: ['index.html', 'index.htm'] })

// Create server
var server = http.createServer(function onRequest (req, res) {
  serve(req, res, finalhandler(req, res))
})

// Listen
server.listen(3000)

Serve all files as downloads

var contentDisposition = require('content-disposition')
var finalhandler = require('finalhandler')
var http = require('http')
var serveStatic = require('serve-static')

// Serve up public/ftp folder
var serve = serveStatic('public/ftp', {
  index: false,
  setHeaders: setHeaders
})

// Set header to force download
function setHeaders (res, path) {
  res.setHeader('Content-Disposition', contentDisposition(path))
}

// Create server
var server = http.createServer(function onRequest (req, res) {
  serve(req, res, finalhandler(req, res))
})

// Listen
server.listen(3000)

Serving using express

Simple

This is a simple example of using Express.

var express = require('express')
var serveStatic = require('serve-static')

var app = express()

app.use(serveStatic('public/ftp', { index: ['default.html', 'default.htm'] }))
app.listen(3000)

Multiple roots

This example shows a simple way to search through multiple directories. Files are searched for in public-optimized/ first, then public/ second as a fallback.

var express = require('express')
var path = require('path')
var serveStatic = require('serve-static')

var app = express()

app.use(serveStatic(path.join(__dirname, 'public-optimized')))
app.use(serveStatic(path.join(__dirname, 'public')))
app.listen(3000)

Different settings for paths

This example shows how to set a different max age depending on the served file. In this example, HTML files are not cached, while everything else is for 1 day.

var express = require('express')
var path = require('path')
var serveStatic = require('serve-static')

var app = express()

app.use(serveStatic(path.join(__dirname, 'public'), {
  maxAge: '1d',
  setHeaders: setCustomCacheControl
}))

app.listen(3000)

function setCustomCacheControl (res, file) {
  if (path.extname(file) === '.html') {
    // Custom Cache-Control for HTML files
    res.setHeader('Cache-Control', 'public, max-age=0')
  }
}

License

MIT

更新履歴

2.2.0 / 2025-03-27

  • deps: send@^1.2.0

2.1.0 / 2024-09-10

  • Changes from 1.16.0
  • deps: send@^1.2.0

2.0.0 / 2024-08-23

  • deps:
    • parseurl@^1.3.3
    • excape-html@^1.0.3
    • encodeurl@^2.0.0
    • supertest@^6.3.4
    • safe-buffer@^5.2.1
    • nyc@^17.0.0
    • mocha@^10.7.0
  • Changes from 1.x

2.0.0-beta.2 / 2024-03-20

  • deps: send@1.0.0-beta.2

2.0.0-beta.1 / 2022-02-05

  • Change dotfiles option default to 'ignore'
  • Drop support for Node.js 0.8
  • Remove hidden option; use dotfiles option instead
  • Remove mime export; use mime-types package instead
  • deps: send@1.0.0-beta.1
    • Use mime-types for file to content type mapping
    • deps: debug@3.1.0

1.16.0 / 2024-09-10

  • Remove link renderization in html while redirecting

1.15.0 / 2022-03-24

  • deps: send@0.18.0
    • Fix emitted 416 error missing headers property
    • Limit the headers removed for 304 response
    • deps: depd@2.0.0
    • deps: destroy@1.2.0
    • deps: http-errors@2.0.0
    • deps: on-finished@2.4.1
    • deps: statuses@2.0.1

1.14.2 / 2021-12-15

  • deps: send@0.17.2
    • deps: http-errors@1.8.1
    • deps: ms@2.1.3
    • pref: ignore empty http tokens

1.14.1 / 2019-05-10

  • Set stricter CSP header in redirect response
  • deps: send@0.17.1
    • deps: range-parser@~1.2.1

1.14.0 / 2019-05-07

  • deps: parseurl@~1.3.3
  • deps: send@0.17.0
    • deps: http-errors@~1.7.2
    • deps: mime@1.6.0
    • deps: ms@2.1.1
    • deps: statuses@~1.5.0
    • perf: remove redundant path.normalize call

1.13.2 / 2018-02-07

  • Fix incorrect end tag in redirects
  • deps: encodeurl@~1.0.2
    • Fix encoding % as last character
  • deps: send@0.16.2
    • deps: depd@~1.1.2
    • deps: encodeurl@~1.0.2
    • deps: statuses@~1.4.0

1.13.1 / 2017-09-29

  • Fix regression when root is incorrectly set to a file
  • deps: send@0.16.1

1.13.0 / 2017-09-27

  • deps: send@0.16.0
    • Add 70 new types for file extensions
    • Add immutable option
    • Fix missing </html> in default error & redirects
    • Set charset as "UTF-8" for .js and .json
    • Use instance methods on steam to check for listeners
    • deps: mime@1.4.1
    • perf: improve path validation speed

1.12.6 / 2017-09-22

  • deps: send@0.15.6
    • deps: debug@2.6.9
    • perf: improve If-Match token parsing
  • perf: improve slash collapsing

1.12.5 / 2017-09-21

  • deps: parseurl@~1.3.2
    • perf: reduce overhead for full URLs
    • perf: unroll the "fast-path" RegExp
  • deps: send@0.15.5
    • Fix handling of modified headers with invalid dates
    • deps: etag@~1.8.1
    • deps: fresh@0.5.2

1.12.4 / 2017-08-05

  • deps: send@0.15.4
    • deps: debug@2.6.8
    • deps: depd@~1.1.1
    • deps: http-errors@~1.6.2

1.12.3 / 2017-05-16

  • deps: send@0.15.3
    • deps: debug@2.6.7

1.12.2 / 2017-04-26

  • deps: send@0.15.2
    • deps: debug@2.6.4

1.12.1 / 2017-03-04

  • deps: send@0.15.1
    • Fix issue when Date.parse does not return NaN on invalid date
    • Fix strict violation in broken environments

1.12.0 / 2017-02-25

  • Send complete HTML document in redirect response
  • Set default CSP header in redirect response
  • deps: send@0.15.0
    • Fix false detection of no-cache request directive
    • Fix incorrect result when If-None-Match has both * and ETags
    • Fix weak ETag matching to match spec
    • Remove usage of res._headers private field
    • Support If-Match and If-Unmodified-Since headers
    • Use res.getHeaderNames() when available
    • Use res.headersSent when available
    • deps: debug@2.6.1
    • deps: etag@~1.8.0
    • deps: fresh@0.5.0
    • deps: http-errors@~1.6.1

1.11.2 / 2017-01-23

  • deps: send@0.14.2
    • deps: http-errors@~1.5.1
    • deps: ms@0.7.2
    • deps: statuses@~1.3.1

1.11.1 / 2016-06-10

  • Fix redirect error when req.url contains raw non-URL characters
  • deps: send@0.14.1

1.11.0 / 2016-06-07

  • Use status code 301 for redirects
  • deps: send@0.14.0
    • Add acceptRanges option
    • Add cacheControl option
    • Attempt to combine multiple ranges into single range
    • Correctly inherit from Stream class
    • Fix Content-Range header in 416 responses when using start/end options
    • Fix Content-Range header missing from default 416 responses
    • Ignore non-byte Range headers
    • deps: http-errors@~1.5.0
    • deps: range-parser@~1.2.0
    • deps: statuses@~1.3.0
    • perf: remove argument reassignment

1.10.3 / 2016-05-30

  • deps: send@0.13.2
    • Fix invalid Content-Type header when send.mime.default_type unset

1.10.2 / 2016-01-19

  • deps: parseurl@~1.3.1
    • perf: enable strict mode

1.10.1 / 2016-01-16

  • deps: escape-html@~1.0.3
    • perf: enable strict mode
    • perf: optimize string replacement
    • perf: use faster string coercion
  • deps: send@0.13.1
    • deps: depd@~1.1.0
    • deps: destroy@~1.0.4
    • deps: escape-html@~1.0.3
    • deps: range-parser@~1.0.3

1.10.0 / 2015-06-17

  • Add fallthrough option
    • Allows declaring this middleware is the final destination
    • Provides better integration with Express patterns
  • Fix reading options from options prototype
  • Improve the default redirect response headers
  • deps: escape-html@1.0.2
  • deps: send@0.13.0
    • Allow Node.js HTTP server to set Date response header
    • Fix incorrectly removing Content-Location on 304 response
    • Improve the default redirect response headers
    • Send appropriate headers on default error response
    • Use http-errors for standard emitted errors
    • Use statuses instead of http module for status messages
    • deps: escape-html@1.0.2
    • deps: etag@~1.7.0
    • deps: fresh@0.3.0
    • deps: on-finished@~2.3.0
    • perf: enable strict mode
    • perf: remove unnecessary array allocations
  • perf: enable strict mode
  • perf: remove argument reassignment

1.9.3 / 2015-05-14

  • deps: send@0.12.3
    • deps: debug@~2.2.0
    • deps: depd@~1.0.1
    • deps: etag@~1.6.0
    • deps: ms@0.7.1
    • deps: on-finished@~2.2.1

1.9.2 / 2015-03-14

  • deps: send@0.12.2
    • Throw errors early for invalid extensions or index options
    • deps: debug@~2.1.3

1.9.1 / 2015-02-17

  • deps: send@0.12.1
    • Fix regression sending zero-length files

1.9.0 / 2015-02-16

  • deps: send@0.12.0
    • Always read the stat size from the file
    • Fix mutating passed-in options
    • deps: mime@1.3.4

1.8.1 / 2015-01-20

  • Fix redirect loop in Node.js 0.11.14
  • deps: send@0.11.1
    • Fix root path disclosure

1.8.0 / 2015-01-05

  • deps: send@0.11.0
    • deps: debug@~2.1.1
    • deps: etag@~1.5.1
    • deps: ms@0.7.0
    • deps: on-finished@~2.2.0

1.7.2 / 2015-01-02

  • Fix potential open redirect when mounted at root

1.7.1 / 2014-10-22

  • deps: send@0.10.1
    • deps: on-finished@~2.1.1

1.7.0 / 2014-10-15

  • deps: send@0.10.0
    • deps: debug@~2.1.0
    • deps: depd@~1.0.0
    • deps: etag@~1.5.0

1.6.5 / 2015-02-04

  • Fix potential open redirect when mounted at root
    • Back-ported from v1.7.2

1.6.4 / 2014-10-08

  • Fix redirect loop when index file serving disabled

1.6.3 / 2014-09-24

  • deps: send@0.9.3
    • deps: etag@~1.4.0

1.6.2 / 2014-09-15

  • deps: send@0.9.2
    • deps: depd@0.4.5
    • deps: etag@~1.3.1
    • deps: range-parser@~1.0.2

1.6.1 / 2014-09-07

  • deps: send@0.9.1
    • deps: fresh@0.2.4

1.6.0 / 2014-09-07

  • deps: send@0.9.0
    • Add lastModified option
    • Use etag to generate ETag header
    • deps: debug@~2.0.0

1.5.4 / 2014-09-04

  • deps: send@0.8.5
    • Fix a path traversal issue when using root
    • Fix malicious path detection for empty string path

1.5.3 / 2014-08-17

  • deps: send@0.8.3

1.5.2 / 2014-08-14

  • deps: send@0.8.2
    • Work around fd leak in Node.js 0.10 for fs.ReadStream

1.5.1 / 2014-08-09

  • Fix parsing of weird req.originalUrl values
  • deps: parseurl@~1.3.0
  • deps: utils-merge@1.0.0

1.5.0 / 2014-08-05

  • deps: send@0.8.1
    • Add extensions option

1.4.4 / 2014-08-04

  • deps: send@0.7.4
    • Fix serving index files without root dir

1.4.3 / 2014-07-29

  • deps: send@0.7.3
    • Fix incorrect 403 on Windows and Node.js 0.11

1.4.2 / 2014-07-27

  • deps: send@0.7.2
    • deps: depd@0.4.4

1.4.1 / 2014-07-26

  • deps: send@0.7.1
    • deps: depd@0.4.3

1.4.0 / 2014-07-21

  • deps: parseurl@~1.2.0
    • Cache URLs based on original value
    • Remove no-longer-needed URL mis-parse work-around
    • Simplify the "fast-path" RegExp
  • deps: send@0.7.0
    • Add dotfiles option
    • deps: debug@1.0.4
    • deps: depd@0.4.2

1.3.2 / 2014-07-11

  • deps: send@0.6.0
    • Cap maxAge value to 1 year
    • deps: debug@1.0.3

1.3.1 / 2014-07-09

  • deps: parseurl@~1.1.3
    • faster parsing of href-only URLs

1.3.0 / 2014-06-28

  • Add setHeaders option
  • Include HTML link in redirect response
  • deps: send@0.5.0
    • Accept string for maxAge (converted by ms)

1.2.3 / 2014-06-11

  • deps: send@0.4.3
    • Do not throw un-catchable error on file open race condition
    • Use escape-html for HTML escaping
    • deps: debug@1.0.2
    • deps: finished@1.2.2
    • deps: fresh@0.2.2

1.2.2 / 2014-06-09

  • deps: send@0.4.2
    • fix "event emitter leak" warnings
    • deps: debug@1.0.1
    • deps: finished@1.2.1

1.2.1 / 2014-06-02

  • use escape-html for escaping
  • deps: send@0.4.1
    • Send max-age in Cache-Control in correct format

1.2.0 / 2014-05-29

  • deps: send@0.4.0
    • Calculate ETag with md5 for reduced collisions
    • Fix wrong behavior when index file matches directory
    • Ignore stream errors after request ends
    • Skip directories in index file search
    • deps: debug@0.8.1

1.1.0 / 2014-04-24

  • Accept options directly to send module
  • deps: send@0.3.0

1.0.4 / 2014-04-07

  • Resolve relative paths at middleware setup
  • Use parseurl to parse the URL from request

1.0.3 / 2014-03-20

  • Do not rely on connect-like environments

1.0.2 / 2014-03-06

  • deps: send@0.2.0

1.0.1 / 2014-03-05

  • Add mime export for back-compat

1.0.0 / 2014-03-05

  • Genesis from connect