Issue: 2994

The middleware to prevent access to SSR resource will fail

[issue link]

I don’t know is it necessary to prevent access to SSR resource.
But I saw it actually has a middleware in /lib/core/renderer.js to do this.

And it would fail if we send path with url encoded.
For example:

GET /_nuxt/server-bundle%2Ejson HTTP/1.1
Host: nuxtjs.org

The first middleware will directly check that it’s not in req.url for every filename in resourceMap.

    // Common URL checks
    this.useMiddleware((req, res, next) => {
      // Prevent access to SSR resources
      if (ssrResourceRegex.test(req.url)) {
        res.statusCode = 404
        return res.end()

Then use serve-static package to serve .nuxt/dist/ files.

    // Serve .nuxt/dist/ files only for production
    // For dev they will be served with devMiddleware
    if (!this.options.dev) {
      const distDir = resolve(this.options.buildDir, 'dist')
        path: this.publicPath,
        handler: serveStatic(distDir, {
          index: false, // Don't serve index.html template
          maxAge: '1y' // 1 year in production

In serve-static package, it will call send packege to serve the file,
server-static directly calls it with send(req, parseUrl(req).pathname, opt).

    var path = parseUrl(req).pathname;

    // create send stream
    var stream = send(req, path, opts)

But before send create the file stream, it would do a url decode on req.path.

  // decode the path
  var path = decode(this.path)

So server-bundle%2Ejson will be decoded to server-bundle.json, and the first middleware won’t match it.

This question is available on Nuxt.js community (#c2595)