Node.js — Serve Static Files

Node.jsBackendHTTPFilesSecurity

Everything comes together: tinyserve serves a folder over HTTP. The helpers you wrote in week 2
(resolveInRoot, resolveFile) are included at the top; a MIME table and sendText too.

Your task

Write createStaticServer(root) and return the server. For each request:

1. Method other than GET/HEAD → 405, Allow: GET, HEAD, body Method Not Allowed.
2. Decode the pathname of req.url (query string ignored). A broken escape → 400
Bad Request.
3. A path segment starting with . (/.env, /.git/config) but not .. → 404
Not Found: hidden files are never served.
4. resolveFile(root, path): 301 with Location (no body), 403 Forbidden,
404 Not Found. Should it throw, 500 Internal Server Error.
5. 200: Content-Type from MIME_TYPES by extension (application/octet-stream when
unknown), Content-Length = the size in bytes, then stream the file into res.
For HEAD, send the same headers and no body.

Error bodies are plain text (sendText). The driver serves a small site and reports status,
Content-Type, Location, Allow, Content-Length (for 200) and body.

Traversal through encoding

new URL() removes /../ from paths, but not an encoded %2F: /docs%2F..%2F..%2Fsecret
only becomes /docs/../../secret once you decode it. That is why resolveInRoot checks
the decoded path.

Sample tests

Test #1Root serves index.html

Input: [{".env":"SECRET=1","README":"no extension","data.bin":"xyz","logo.svg":"<svg xmlns=\"http://www.w3.org/2000/svg\"/>","index.html":"<h1>Home</h1>","css/app.css":"body { margin: 0 }","notes/todo.txt":"café","docs/index.html":"<h1>Docs</h1>"},[{"path":"/"}]]

Output: [{"body":"<h1>Home</h1>","type":"text/html; charset=utf-8","length":"13","status":200}]

Test #2MIME types

Output: [{"body":"body { margin: 0 }","type":"text/css; charset=utf-8","length":"18","status":200},{"body":"<svg xmlns=\"http://www.w3.org/2000/svg\"/>","type":"image/svg+xml","length":"41","status":200}]

Test #3Missing and hidden files

Output: [{"body":"Not Found","type":"text/plain; charset=utf-8","status":404},{"body":"Not Found","type":"text/plain; charset=utf-8","status":404}]

Test #4Folder redirect, then its index

Output: [{"body":"","status":301,"location":"/docs/"},{"body":"<h1>Docs</h1>","type":"text/html; charset=utf-8","length":"13","status":200}]

Test #5HEAD: headers only

Output: [{"body":"","type":"text/css; charset=utf-8","length":"18","status":200}]

Test #6Wrong method

Output: [{"body":"Method Not Allowed","type":"text/plain; charset=utf-8","allow":"GET, HEAD","status":405}]