amirho/expressjs.com
1
0
Fork 0
mirror of https://github.com/expressjs/expressjs.com.git synced 2026-02-22 03:51:33 +00:00
Code Issues Packages Projects Releases Wiki Activity

docs(migrating-5): add section about express.static dotfiles defaulting to ignore (#1987) (#1989)

Browse Source 
Co-authored-by: bjohansebas <103585995+bjohansebas@users.noreply.github.com>
This commit is contained in:
Vishal Mahajan
2025-08-01 16:49:42 -07:00
committed by GitHub
parent 8c4ae2a056
commit b8d426e360
1 changed files with 26 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

26
en/guide/migrating-5.md
View File

@@ -66,6 +66,7 @@ You can find the list of available codemods [here](https://github.com/expressjs/
<li><a href="#path-syntax">Path route matching syntax</a></li>
<li><a href="#rejected-promises">Rejected promises handled from middleware and handlers</a></li>
<li><a href="#express.urlencoded">express.urlencoded</a></li>
<li><a href="#express.static.dotfiles">express.static dotfiles</a></li>
<li><a href="#app.listen">app.listen</a></li>
<li><a href="#app.router">app.router</a></li>
<li><a href="#req.body">req.body</a></li>
@@ -76,6 +77,7 @@ You can find the list of available codemods [here](https://github.com/expressjs/
<li><a href="#res.vary">res.vary</a></li>
</ul>
**Improvements**
<ul class="doclist">
@@ -462,6 +464,30 @@ Details of how Express handles errors is covered in the [error handling document
The `express.urlencoded` method makes the `extended` option `false` by default.
<h3 id="express.static.dotfiles">express.static dotfiles</h3>
In Express 5, the `express.static` middleware's `dotfiles` option now defaults to `"ignore"`. This is a change from Express 4, where dotfiles were served by default. As a result, files inside a directory that starts with a dot (`.`), such as `.well-known`, will no longer be accessible and will return a **404 Not Found** error. This can break functionality that depends on serving dot-directories, such as Android App Links, and Apple Universal Links.
Example of breaking code:
```js
// v4
app.use(express.static('public'))
```
After migrating to Express 5, a request to `/.well-known/assetlinks.json` will result in a **404 Not Found**.
To fix this, serve specific dot-directories explicitly using the `dotfiles: "allow"` option:
```js
// v5
app.use('/.well-known', express.static('public/.well-known', { dotfiles: 'allow' }))
app.use(express.static('public'))
```
This approach allows you to safely serve only the intended dot-directories while keeping the default secure behavior for other dotfiles, which remain inaccessible.
<h3 id="app.listen">app.listen</h3>
In Express 5, the `app.listen` method will invoke the user-provided callback function (if provided) when the server receives an error event. In Express 4, such errors would be thrown. This change shifts error-handling responsibility to the callback function in Express 5. If there is an error, it will be passed to the callback as an argument.