The server object is the main application container. The server manages all incoming requests along with all the facilities provided by the framework. Each server supports a single connection (e.g. listen to port 80).

Creates a new server object where:

• options - (optional) a server configuration object.

const Hapi = require('@hapi/hapi');

const server = Hapi.server({ load: { sampleInterval: 1000 } });

The server options control the behavior of the server object. Note that the options object is deeply cloned (with the exception of listener which is shallowly copied) and should not contain any values that are unsafe to perform deep copy on.

All options are optionals.

Default value: '::' if IPv6 is available, otherwise '0.0.0.0' (i.e. all available network interfaces).

Sets the hostname or IP address the server will listen on. If not configured, defaults to host if present, otherwise to all available network interfaces. Set to '127.0.0.1', '::1', or 'localhost' to restrict the server to only those coming from the same host.

Default value: {}.

Provides application-specific configuration which can later be accessed via server.settings.app. The framework does not interact with this object. It is simply a reference made available anywhere a server reference is provided.

Note the difference between server.settings.app which is used to store static configuration values and server.app which is meant for storing run-time state.

Default value: true.

Used to disable the automatic initialization of the listener. When false, indicates that the listener will be started manually outside the framework.

Cannot be set to false along with a port value.

Default value: { provider: { constructor: require('@hapi/catbox-memory'), options: { partition: 'hapi-cache' } } }.

Sets up server-side caching providers. Every server includes a default cache for storing application state. By default, a simple memory-based cache is created which has limited capacity and capabilities.

hapi uses catbox for its cache implementation which includes support for common storage solutions (e.g. Redis, MongoDB, Memcached, Riak, among others). Caching is only utilized if methods and plugins explicitly store their state in the cache.

The server cache configuration only defines the storage container itself. The configuration can be assigned one or more (array):

• a class or prototype function (usually obtained by calling require() on a catbox strategy such as require('@hapi/catbox-redis')). A new catbox client will be created internally using this constructor.

• a configuration object with the following:

  • engine - a catbox engine object instance.

  • name - an identifier used later when provisioning or configuring caching for server methods or plugins. Each cache name must be unique. A single item may omit the name option which defines the default cache. If every cache includes a name, a default memory cache is provisioned as well.

  • provider - a class, a constructor function, or an object with the following:

    • constructor - a class or a prototype function.

    • options - (optional) a settings object passed as-is to the constructor with the following:

      • partition - (optional) string used to isolate cached data. Defaults to 'hapi-cache'.
      • other constructor-specific options passed to the constructor on instantiation.

  • shared - if true, allows multiple cache users to share the same segment (e.g. multiple methods using the same cache storage container). Default to false.

  • One (and only one) of engine or provider is required per configuration object.

Default value: { minBytes: 1024 }.

Defines server handling of content encoding requests. If false, response content encoding is disabled and no compression is performed by the server.

Default value: '1024'.

Sets the minimum response payload size in bytes that is required for content encoding compression. If the payload size is under the limit, no compression is performed.

Default value: { request: ['implementation'] }.

Determines which logged events are sent to the console. This should only be used for development and does not affect which events are actually logged internally and recorded. Set to false to disable all console logging, or to an object with:

• log - a string array of server log tags to be displayed via console.error() when the events are logged via server.log() as well as internally generated server logs. Defaults to no output.

• request - a string array of request log tags to be displayed via console.error() when the events are logged via request.log() as well as internally generated request logs. For example, to display all errors, set the option to ['error']. To turn off all console debug messages set it to false. To display all request logs, set it to '*'. Defaults to uncaught errors thrown in external code (these errors are handled automatically and result in an Internal Server Error response) or runtime errors due to developer error.

For example, to display all errors, set the log or request to ['error']. To turn off all output set the log or request to false. To display all server logs, set the log or request to '*'. To disable all debug information, set debug to false.

Default value: the operating system hostname and if not available, to 'localhost'.

The public hostname or IP address. Used to set server.info.host and server.info.uri and as address if none is provided.

Default value: false.

If true, the request.info.remoteAddress and request.info.remotePort are populated when the request is received which can consume more resource (but is ok if the information is needed, especially for aborted requests). When false, the fields are only populated upon demand (but will be undefined if accessed after the request is aborted).

Default value: none.

An optional node HTTP (or HTTPS) http.Server object (or an object with a compatible interface).

If the listener needs to be manually started, set autoListen to false.

If the listener uses TLS, set tls to true.

Default value: { sampleInterval: 0, maxHeapUsedBytes: 0, maxRssBytes: 0, maxEventLoopDelay: 0, maxEventLoopUtilization: 0 }.

Server excessive load handling limits where:

• sampleInterval - the frequency of sampling in milliseconds. When set to 0, the other load options are ignored. Defaults to 0 (no sampling).

• maxHeapUsedBytes - maximum V8 heap size over which incoming requests are rejected with an HTTP Server Timeout (503) response. Defaults to 0 (no limit).

• maxRssBytes - maximum process RSS size over which incoming requests are rejected with an HTTP Server Timeout (503) response. Defaults to 0 (no limit).

• maxEventLoopDelay - maximum event loop delay duration in milliseconds over which incoming requests are rejected with an HTTP Server Timeout (503) response. Defaults to 0 (no limit).

• maxEventLoopUtilization - maximum event loop utilization value over which incoming requests are rejected with an HTTP Server Timeout (503) response. Defaults to 0 (no limit).

Default value: none.

Options passed to the mimos module when generating the mime database used by the server (and accessed via server.mime):

• override - an object hash that is merged into the built in mime information specified here. Each key value pair represents a single mime object. Each override value must contain:

  • key - the lower-cased mime-type string (e.g. 'application/javascript').

  • value - an object following the specifications outlined here. Additional values include:

    • type - specify the type value of result objects, defaults to key.

    • predicate - method with signature function(mime) when this mime type is found in the database, this function will execute to allows customizations.

const options = {
    mime: {
        override: {
            'node/module': {
                source: 'iana',
                compressible: true,
                extensions: ['node', 'module', 'npm'],
                type: 'node/module'
            },
            'application/javascript': {
                source: 'iana',
                charset: 'UTF-8',
                compressible: true,
                extensions: ['js', 'javascript'],
                type: 'text/javascript'
            },
            'text/html': {
                predicate: function(mime) {
                    if (someCondition) {
                        mime.foo = 'test';
                    }
                    else {
                        mime.foo = 'bar';
                    }
                    return mime;
                }
            }
        }
    }
};

Default value: { cleanStop: true }.

Defines server handling of server operations:

• cleanStop - if true, the server keeps track of open connections and properly closes them when the server is stopped. Under normal load, this should not interfere with server performance. However, under severe load connection monitoring can consume additional resources and aggravate the situation. If the server is never stopped, or if it is forced to stop without waiting for open connection to close, setting this to false can save resources that are not being utilized anyway. Defaults to true.

Default value: {}.

Plugin-specific configuration which can later be accessed via server.settings.plugins. plugins is an object where each key is a plugin name and the value is the configuration. Note the difference between server.settings.plugins which is used to store static configuration values and server.plugins which is meant for storing run-time state.

Default value: 0 (an ephemeral port).

The TCP port the server will listen to. Defaults the next available port when the server is started (and assigned to server.info.port).

If port is a string containing a '/' character, it is used as a UNIX domain socket path. If it starts with '\.\pipe', it is used as a Windows named pipe.

Default value: {}.

Defines server handling of the request path query component.

Default value: none.

Sets a query parameters parser method using the signature function(query) where:

• query - an object containing the incoming request.query parameters.
• the method must return an object where each key is a parameter and matching value is the parameter value. If the method throws, the error is used as the response or returned when request.setUrl() is called.

const Qs = require('qs');

const options = {
    query: {
        parser: (query) => Qs.parse(query)
    }
};

Default value: { isCaseSensitive: true, stripTrailingSlash: false }.

Controls how incoming request URIs are matched against the routing table:

• isCaseSensitive - determines whether the paths '/example' and '/EXAMPLE' are considered different resources. Defaults to true.

• stripTrailingSlash - removes trailing slashes on incoming paths. Defaults to false.

Default value: none.

A route options object used as the default configuration for every route.

Default value:

{
    strictHeader: true,
    ignoreErrors: false,
    isSecure: true,
    isHttpOnly: true,
    isSameSite: 'Strict',
    encoding: 'none'
}

Sets the default configuration for every state (cookie) set explicitly via server.state() or implicitly (without definition) using the state configuration object.

Default value: none.

Used to create an HTTPS connection. The tls object is passed unchanged to the node HTTPS server as described in the node HTTPS documentation.

Set to true when passing a listener object that has been configured to use TLS directly.

Default value: constructed from runtime server information.

The full public URI without the path (e.g. 'http://example.com:8080'). If present, used as the server server.info.uri, otherwise constructed from the server settings.

Access: read / write.

Provides a safe place to store server-specific run-time application data without potential conflicts with the framework internals. The data can be accessed whenever the server is accessible. Initialized with an empty object.

const server = Hapi.server();

server.app.key = 'value';

const handler = function (request, h) {

    return request.server.app.key;        // 'value'
};

Access: authentication strategy specific.

An object where each key is an authentication strategy name and the value is the exposed strategy API. Available only when the authentication scheme exposes an API by returning an api key in the object returned from its implementation function.

const server = Hapi.server({ port: 80 });

const scheme = function (server, options) {

    return {
        api: {
            settings: {
                x: 5
            }
        },
        authenticate: function (request, h) {

            const authorization = request.headers.authorization;
            if (!authorization) {
                throw Boom.unauthorized(null, 'Custom');
            }

            return h.authenticated({ credentials: { user: 'john' } });
        }
    };
};

server.auth.scheme('custom', scheme);
server.auth.strategy('default', 'custom');

console.log(server.auth.api.default.settings.x);    // 5

Access: read only.

Contains the default authentication configuration if a default strategy was set via server.auth.default().

Access: read only.

Provides access to the decorations already applied to various framework interfaces. The object must not be modified directly, but only through server.decorate. Contains:

• request - decorations on the request object.
• response - decorations on the response object.
• toolkit - decorations on the response toolkit.
• server - decorations on the server object.

const Hapi = require('@hapi/hapi');
const server = Hapi.server({ port: 80 });

const success = function () {

    return this.response({ status: 'ok' });
};

server.decorate('toolkit', 'success', success);
console.log(server.decorations.toolkit);            // ['success']

Access: podium public interface.

The server events emitter. Utilizes the podium with support for event criteria validation, channels, and filters.

Use the following methods to interact with server.events:

• server.event(events) - register application events.
• server.events.emit(criteria, data) - emit server events.
• server.events.on(criteria, listener, context) - subscribe to all events.
• server.events.once(criteria, listener, context) - subscribe to a single event.

Other methods include: server.events.removeListener(name, listener), server.events.removeAllListeners(name), and server.events.hasListeners(name).

The 'log' event type emits internal server events generated by the framework as well as application events logged with server.log().

The 'log' event handler uses the function signature function(event, tags) where:

• event - an object with the following properties:

  • timestamp - the event timestamp.
  • tags - an array of tags identifying the event (e.g. ['error', 'http']).
  • channel - set to 'internal' for internally generated events, otherwise 'app' for events generated by server.log().
  • data - event-specific information. Available when event data was provided and is not an error. Errors are passed via error.
  • error - the error object related to the event if applicable. Cannot appear together with data.

• tags - an object where each event.tag is a key and the value is true. Useful for quick identification of events.

server.events.on('log', (event, tags) => {

    if (tags.error) {
        console.log(`Server error: ${event.error ? event.error.message : 'unknown'}`);
    }
});

The internally generated events are (identified by their tags):

• load - logs the current server load measurements when the server rejects a request due to high load. The event data contains the process load metrics.

• connection client error - a clientError event was received from the HTTP or HTTPS listener. The event data is the error object received.

The 'cachePolicy' event type is emitted when a server cache policy is created via server.cache() or a server.method() with caching enabled is registered. The 'cachePolicy' event handler uses the function signature function(cachePolicy, cache, segment) where:

• cachePolicy - the catbox cache policy.
• cache - the cache provision name used when the policy was created or undefined if the default cache was used.
• segment - the segment name used when the policy was created.

server.events.on('cachePolicy', (cachePolicy, cache, segment) => {

    console.log(`New cache policy created using cache: ${cache === undefined ? 'default' : cache} and segment: ${segment}`);
});

The 'request' event type emits internal request events generated by the framework as well as application events logged with request.log().

The 'request' event handler uses the function signature function(request, event, tags) where:

• request - the request object.

• event - an object with the following properties:

  • timestamp - the event timestamp.
  • tags - an array of tags identifying the event (e.g. ['error', 'http']).
  • channel - one of
    • 'app' - events generated by request.log().
    • 'error' - emitted once per request if the response had a 500 status code.
    • 'internal' - internally generated events.
  • request - the request identifier.
  • data - event-specific information. Available when event data was provided and is not an error. Errors are passed via error.
  • error - the error object related to the event if applicable. Cannot appear together with data.

• tags - an object where each event.tag is a key and the value is true. Useful for quick identification of events.

server.events.on('request', (request, event, tags) => {

    if (tags.error) {
        console.log(`Request ${event.request} error: ${event.error ? event.error.message : 'unknown'}`);
    }
});

To listen to only one of the channels, use the event criteria object:

server.events.on({ name: 'request', channels: 'error' }, (request, event, tags) => {

    console.log(`Request ${event.request} failed`);
});

The internally generated events are (identified by their tags):

• accept-encoding error - a request received contains an invalid Accept-Encoding header.
• auth unauthenticated - no authentication scheme included with the request.
• auth unauthenticated response {strategy} - the authentication strategy listed returned a non-error response (e.g. a redirect to a login page).
• auth unauthenticated error {strategy} - the request failed to pass the listed authentication strategy (invalid credentials).
• auth unauthenticated missing {strategy} - the request failed to pass the listed authentication strategy (no credentials found).
• auth unauthenticated try {strategy} - the request failed to pass the listed authentication strategy in 'try' mode and will continue.
• auth scope error - the request authenticated but failed to meet the scope requirements.
• auth entity user error - the request authenticated but included an application entity when a user entity was required.
• auth entity app error - the request authenticated but included a user entity when an application entity was required.
• ext error - an onPostResponse extension handler errored.
• handler error - the route handler returned an error. Includes the execution duration and the error message.
• pre error - a pre method was executed and returned an error. Includes the execution duration, assignment key, and error.
• internal error - an HTTP 500 error response was assigned to the request.
• internal implementation error - an incorrectly implemented lifecycle method.
• request abort error - the request aborted.
• request closed error - the request closed prematurely.
• request error - the request stream emitted an error. Includes the error.
• request server timeout error - the request took too long to process by the server. Includes the timeout configuration value and the duration.
• state error - the request included an invalid cookie or cookies. Includes the cookies and error details.
• state response error - the response included an invalid cookie which prevented generating a valid header. Includes the error.
• payload error - failed processing the request payload. Includes the error.
• response error - failed writing the response to the client. Includes the error.
• response error close - failed writing the response to the client due to prematurely closed connection.
• response error aborted - failed writing the response to the client due to prematurely aborted connection.
• response error cleanup - failed freeing response resources.
• validation error {input} - input (i.e. payload, query, params, headers) validation failed. Includes the error. Only emitted when failAction is set to 'log'.
• validation response error - response validation failed. Includes the error message. Only emitted when failAction is set to 'log'.

The 'response' event type is emitted after the response is sent back to the client (or when the client connection closed and no response sent, in which case request.response is null). A single event is emitted per request. The 'response' event handler uses the function signature function(request) where:

• request - the request object.

server.events.on('response', (request) => {

    console.log(`Response sent for request: ${request.info.id}`);
});

The 'route' event type is emitted when a route is added via server.route(). The 'route' event handler uses the function signature function(route) where:

• route - the route information. The route object must not be modified.

server.events.on('route', (route) => {

    console.log(`New route added: ${route.path}`);
});

The 'start' event type is emitted when the server is started using server.start(). The 'start' event handler uses the function signature function().

server.events.on('start', () => {

    console.log('Server started');
});

The 'closing' event type is emitted when the server is stopped using server.stop(). It is triggered when incoming requests are no longer accepted but before all underlying active connections have been closed, and thus before the 'stop' event is triggered. The 'closing' event handler uses the function signature function().

server.events.on('closing', () => {

    console.log('Server is closing');
});

The 'stop' event type is emitted when the server is stopped using server.stop(). The 'stop' event handler uses the function signature function().

server.events.on('stop', () => {

    console.log('Server stopped');
});

Access: read only.

An object containing information about the server where:

• id - a unique server identifier (using the format '{hostname}:{pid}:{now base36}').

• created - server creation timestamp.

• started - server start timestamp (0 when stopped).

• port - the connection port based on the following rules:

  • before the server has been started: the configured port value.
  • after the server has been started: the actual port assigned when no port is configured or was set to 0.

• host - The host configuration value.

• address - the active IP address the connection was bound to after starting. Set to undefined until the server has been started or when using a non TCP port (e.g. UNIX domain socket).

• protocol - the protocol used:

  • 'http' - HTTP.
  • 'https' - HTTPS.
  • 'socket' - UNIX domain socket or Windows named pipe.

• uri - a string representing the connection (e.g. 'http://example.com:8080' or 'socket:/unix/domain/socket/path'). Contains the uri value if set, otherwise constructed from the available settings. If no port is configured or is set to 0, the uri will not include a port component until the server is started.

const Hapi = require('@hapi/hapi');
const server = Hapi.server({ port: 80 });

console.log(server.info.port);            // 80

Access: read only and listener public interface.

The node HTTP server object.

const Hapi = require('@hapi/hapi');
const SocketIO = require('socket.io');

const server = Hapi.server({ port: 80 });

const io = SocketIO.listen(server.listener);
io.sockets.on('connection', (socket) => {

    socket.emit({ msg: 'welcome' });
});

Access: read only.

An object containing the process load metrics (when load.sampleInterval is enabled):

• eventLoopDelay - event loop delay milliseconds.
• eventLoopUtilization - current event loop utilization value.
• heapUsed - V8 heap usage.
• rss - RSS memory usage.

const Hapi = require('@hapi/hapi');
const server = Hapi.server({ load: { sampleInterval: 1000 } });

console.log(server.load.rss);

Access: read only.

Server methods are functions registered with the server and used throughout the application as a common utility. Their advantage is in the ability to configure them to use the built-in cache and share across multiple request handlers without having to create a common module.

sever.methods is an object which provides access to the methods registered via server.method() where each server method name is an object property.

const Hapi = require('@hapi/hapi');
const server = Hapi.server();

server.method('add', (a, b) => (a + b));
const result = server.methods.add(1, 2);    // 3

Access: read only and mimos public interface.

Provides access to the server MIME database used for setting content-type information. The object must not be modified directly but only through the mime server setting.

const Hapi = require('@hapi/hapi');

const options = {
    mime: {
        override: {
            'node/module': {
                source: 'steve',
                compressible: false,
                extensions: ['node', 'module', 'npm'],
                type: 'node/module'
            }
        }
    }
};

const server = Hapi.server(options);
console.log(server.mime.path('code.js').type)        // 'application/javascript'
console.log(server.mime.path('file.npm').type)        // 'node/module'

Access: read / write.

An object containing the values exposed by each registered plugin where each key is a plugin name and the values are the exposed properties by each plugin using server.expose(). Plugins may set the value of the server.plugins[name] object directly or via the server.expose() method.

exports.plugin = {
    name: 'example',
    register: function (server, options) {

        server.expose('key', 'value');
        server.plugins.example.other = 'other';

        console.log(server.plugins.example.key);      // 'value'
        console.log(server.plugins.example.other);    // 'other'
    }
};

Access: read only.

The realm object contains sandboxed server settings specific to each plugin or authentication strategy. When registering a plugin or an authentication scheme, a server object reference is provided with a new server.realm container specific to that registration. It allows each plugin to maintain its own settings without leaking and affecting other plugins.

For example, a plugin can set a default file path for local resources without breaking other plugins' configured paths. When calling server.bind(), the active realm's settings.bind property is set which is then used by routes and extensions added at the same level (server root or plugin).

The server.realm object contains:

• modifiers - when the server object is provided as an argument to the plugin register() method, modifiers provides the registration preferences passed the server.register() method and includes:

  • route - routes preferences:

    • prefix - the route path prefix used by any calls to server.route() from the server. Note that if a prefix is used and the route path is set to '/', the resulting path will not include the trailing slash.
    • vhost - the route virtual host settings used by any calls to server.route() from the server.

• parent - the realm of the parent server object, or null for the root server.

• plugin - the active plugin name (empty string if at the server root).

• pluginOptions - the plugin options passed at registration.

• plugins - plugin-specific state to be shared only among activities sharing the same active state. plugins is an object where each key is a plugin name and the value is the plugin state.

• settings - settings overrides:

  • files.relativeTo
  • bind

The server.realm object should be considered read-only and must not be changed directly except for the plugins property which can be directly manipulated by each plugin, setting its properties inside plugins[name].

exports.register = function (server, options) {

    console.log(server.realm.modifiers.route.prefix);
};

Access: read only.

An object of the currently registered plugins where each key is a registered plugin name and the value is an object containing:

• version - the plugin version.
• name - the plugin name.
• options - (optional) options passed to the plugin during registration.

Access: read only.

The server configuration object after defaults applied.

const Hapi = require('@hapi/hapi');
const server = Hapi.server({
    app: {
        key: 'value'
    }
});

console.log(server.settings.app);   // { key: 'value' }

Access: read only and statehood public interface.

The server cookies manager.

Access: read only.

The server cookies manager settings. The settings are based on the values configured in server.options.state.

Access: read only.

An object containing the configuration of each cookie added via server.state() where each key is the cookie name and value is the configuration object.

Access: read only.

An array containing the names of all configured cookies.

Access: read only.

A string indicating the listener type where:

• 'socket' - UNIX domain socket or Windows named pipe.
• 'tcp' - an HTTP listener.

Access: read only.

The hapi module version number.

const Hapi = require('@hapi/hapi');
const server = Hapi.server();

console.log(server.version);        // '17.0.0'

Sets a default strategy which is applied to every route where:

• options - one of:

  • a string with the default strategy name
  • an authentication configuration object using the same format as the route auth handler options.

Return value: none.

The default does not apply when a route config specifies auth as false, or has an authentication strategy configured (contains the strategy or strategies authentication settings). Otherwise, the route authentication config is applied to the defaults.

Note that if the route has authentication configured, the default only applies at the time of adding the route, not at runtime. This means that calling server.auth.default() after adding a route with some authentication config will have no impact on the routes added prior. However, the default will apply to routes added before server.auth.default() is called if those routes lack any authentication config.

The default auth strategy configuration can be accessed via server.auth.settings.default. To obtain the active authentication configuration of a route, use server.auth.lookup(request.route).

const Hapi = require('@hapi/hapi');
const server = Hapi.server({ port: 80 });

server.auth.scheme('custom', scheme);
server.auth.strategy('default', 'custom');
server.auth.default('default');

server.route({
    method: 'GET',
    path: '/',
    handler: function (request, h) {

        return request.auth.credentials.user;
    }
});

Registers an authentication scheme where:

• name - the scheme name.
• scheme - the method implementing the scheme with signature function(server, options) where:
  • server - a reference to the server object the scheme is added to. Each auth strategy is given its own server.realm whose parent is the realm of the server in the call to server.auth.strategy().
  • options - (optional) the scheme options argument passed to server.auth.strategy() when instantiation a strategy.

Return value: none.

The scheme function must return an authentication scheme object when invoked.

An authentication scheme is an object with the following properties:

• api - (optional) object which is exposed via the server.auth.api object.

• async authenticate(request, h) - (required) a lifecycle method function called for each incoming request configured with the authentication scheme. The method is provided with two special toolkit methods for returning an authenticated or an unauthenticate result:

  • h.authenticated() - indicate request authenticated successfully.
  • h.unauthenticated() - indicate request failed to authenticate.

• async payload(request, h) - (optional) a lifecycle method to authenticate the request payload.

• async response(request, h) - (optional) a lifecycle method to decorate the response with authentication headers before the response headers or payload is written.

• async verify(auth) - (optional) a method used to verify the authentication credentials provided are still valid (e.g. not expired or revoked after the initial authentication) where:

  • auth - the request.auth object containing the credentials and artifacts objects returned by the scheme's authenticate() method.
  • the method throws an Error when the credentials passed are no longer valid (e.g. expired or revoked). Note that the method does not have access to the original request, only to the credentials and artifacts produced by the authenticate() method.

• options - (optional) an object with the following keys:

  • payload - if true, requires payload validation as part of the scheme and forbids routes from disabling payload auth validation. Defaults to false.

When the scheme authenticate() method implementation throws an error or calls h.unauthenticated(), the specifics of the error affect whether additional authentication strategies will be attempted (if configured for the route). If the error includes a message, no additional strategies will be attempted. If the err does not include a message but does include the scheme name (e.g. Boom.unauthorized(null, 'Custom')), additional strategies will be attempted in the order of preference (defined in the route configuration). If authentication fails, the scheme names will be present in the 'WWW-Authenticate' header.

When the scheme payload() method throws an error with a message, it means payload validation failed due to bad payload. If the error has no message but includes a scheme name (e.g. Boom.unauthorized(null, 'Custom')), authentication may still be successful if the route auth.payload configuration is set to 'optional'.

const Hapi = require('@hapi/hapi');
const server = Hapi.server({ port: 80 });

const scheme = function (server, options) {

    return {
        authenticate: function (request, h) {

            const req = request.raw.req;
            const authorization = req.headers.authorization;
            if (!authorization) {
                throw Boom.unauthorized(null, 'Custom');
            }

            return h.authenticated({ credentials: { user: 'john' } });
        }
    };
};

server.auth.scheme('custom', scheme);

Registers an authentication strategy where:

• name - the strategy name.
• scheme - the scheme name (must be previously registered using server.auth.scheme()).
• options - scheme options based on the scheme requirements.

Return value: none.

const Hapi = require('@hapi/hapi');
const server = Hapi.server({ port: 80 });

server.auth.scheme('custom', scheme);
server.auth.strategy('default', 'custom');

server.route({
    method: 'GET',
    path: '/',
    options: {
        auth: 'default',
        handler: function (request, h) {

            return request.auth.credentials.user;
        }
    }
});

Tests a request against an authentication strategy where:

• strategy - the strategy name registered with server.auth.strategy().
• request - the request object.

Return value: an object containing the authentication credentials and artifacts if authentication was successful, otherwise throws an error.

Note that the test() method does not take into account the route authentication configuration. It also does not perform payload authentication. It is limited to the basic strategy authentication execution. It does not include verifying scope, entity, or other route properties.

const Hapi = require('@hapi/hapi');
const server = Hapi.server({ port: 80 });

server.auth.scheme('custom', scheme);
server.auth.strategy('default', 'custom');

server.route({
    method: 'GET',
    path: '/',
    handler: async function (request, h) {

        try {
            const { credentials, artifacts } = await request.server.auth.test('default', request);
            return { status: true, user: credentials.name };
        }
        catch (err) {
            return { status: false };
        }
    }
});

Verify a request's authentication credentials against an authentication strategy where:

• request - the request object.

Return value: nothing if verification was successful, otherwise throws an error.

Note that the verify() method does not take into account the route authentication configuration or any other information from the request other than the request.auth object. It also does not perform payload authentication. It is limited to verifying that the previously valid credentials are still valid (e.g. have not been revoked or expired). It does not include verifying scope, entity, or other route properties.

const Hapi = require('@hapi/hapi');
const server = Hapi.server({ port: 80 });

server.auth.scheme('custom', scheme);
server.auth.strategy('default', 'custom');

server.route({
    method: 'GET',
    path: '/',
    handler: async function (request, h) {

        try {
            const credentials = await request.server.auth.verify(request);
            return { status: true, user: credentials.name };
        }
        catch (err) {
            return { status: false };
        }
    }
});

Sets a global context used as the default bind object when adding a route or an extension where:

• context - the object used to bind this in lifecycle methods such as the route handler and extension methods. The context is also made available as h.context.

Return value: none.

When setting a context inside a plugin, the context is applied only to methods set up by the plugin. Note that the context applies only to routes and extensions added after it has been set. Ignored if the method being bound is an arrow function.

const handler = function (request, h) {

    return this.message;    // Or h.context.message
};

exports.plugin = {
    name: 'example',
    register: function (server, options) {

        const bind = {
            message: 'hello'
        };

        server.bind(bind);
        server.route({ method: 'GET', path: '/', handler });
    }
};

Provisions a cache segment within the server cache facility where:

• options - catbox policy configuration where:

  • expiresIn - relative expiration expressed in the number of milliseconds since the item was saved in the cache. Cannot be used together with expiresAt.

  • expiresAt - time of day expressed in 24h notation using the 'HH:MM' format, at which point all cache records expire. Uses local time. Cannot be used together with expiresIn.

  • generateFunc - a function used to generate a new cache item if one is not found in the cache when calling get(). The method's signature is async function(id, flags) where:

    - `id` - the `id` string or object provided to the `get()` method.
    - `flags` - an object used to pass back additional flags to the cache where:
        - `ttl` - the cache ttl value in milliseconds. Set to `0` to skip storing in the
          cache. Defaults to the cache global policy.
    

  • staleIn - number of milliseconds to mark an item stored in cache as stale and attempt to regenerate it when generateFunc is provided. Must be less than expiresIn.

  • staleTimeout - number of milliseconds to wait before checking if an item is stale.

  • generateTimeout - number of milliseconds to wait before returning a timeout error when the generateFunc function takes too long to return a value. When the value is eventually returned, it is stored in the cache for future requests. Required if generateFunc is present. Set to false to disable timeouts which may cause all get() requests to get stuck forever.

  • generateOnReadError - if false, an upstream cache read error will stop the cache.get() method from calling the generate function and will instead pass back the cache error. Defaults to true.

  • generateIgnoreWriteError - if false, an upstream cache write error when calling cache.get() will be passed back with the generated value when calling. Defaults to true.

  • dropOnError - if true, an error or timeout in the generateFunc causes the stale value to be evicted from the cache. Defaults to true.

  • pendingGenerateTimeout - number of milliseconds while generateFunc call is in progress for a given id, before a subsequent generateFunc call is allowed. Defaults to 0 (no blocking of concurrent generateFunc calls beyond staleTimeout).

  • cache - the cache name configured in server.cache. Defaults to the default cache.

  • segment - string segment name, used to isolate cached items within the cache partition. When called within a plugin, defaults to '!name' where 'name' is the plugin name. When called within a server method, defaults to '#name' where 'name' is the server method name. Required when called outside of a plugin.

  • shared - if true, allows multiple cache provisions to share the same segment. Default to false.

Return value: a catbox policy object.

const Hapi = require('@hapi/hapi');

async function example() {

    const server = Hapi.server({ port: 80 });
    const cache = server.cache({ segment: 'countries', expiresIn: 60 * 60 * 1000 });
    await cache.set('norway', { capital: 'oslo' });
    const value = await cache.get('norway');
}

Provisions a server cache as described in server.cache where:

• options - same as the server cache configuration options.

Return value: none.

Note that if the server has been initialized or started, the cache will be automatically started to match the state of any other provisioned server cache.

const Hapi = require('@hapi/hapi');

async function example() {

    const server = Hapi.server({ port: 80 });
    await server.initialize();
    await server.cache.provision({ provider: require('@hapi/catbox-memory'), name: 'countries' });

    const cache = server.cache({ cache: 'countries', expiresIn: 60 * 60 * 1000 });
    await cache.set('norway', { capital: 'oslo' });
    const value = await cache.get('norway');
}

Links another server to the initialize/start/stop state of the current server by calling the controlled server initialize()/start()/stop() methods whenever the current server methods are called, where:

• server - the hapi server object to be controlled.

Registers a custom content decoding compressor to extend the built-in support for 'gzip' and 'deflate' where:

• encoding - the decoder name string.

• decoder - a function using the signature function(options) where options are the encoding specific options configured in the route payload.compression configuration option, and the return value is an object compatible with the output of node's zlib.createGunzip().

Return value: none.

const Zlib = require('zlib');
const Hapi = require('@hapi/hapi');
const server = Hapi.server({ port: 80, routes: { payload: { compression: { special: { chunkSize: 16 * 1024 } } } } });

server.decoder('special', (options) => Zlib.createGunzip(options));

Extends various framework interfaces with custom methods where:

• type - the interface being decorated. Supported types:

  • 'handler' - adds a new handler type to be used in routes handlers.
  • 'request' - adds methods to the Request object.
  • 'response' - adds methods to the Response object.
  • 'server' - adds methods to the Server object.
  • 'toolkit' - adds methods to the response toolkit.

• property - the object decoration key name or symbol.

• method - the extension function or other value.

• options - (optional) supports the following optional settings:

  • apply - when the type is 'request', if true, the method function is invoked using the signature function(request) where request is the current request object and the returned value is assigned as the decoration.
  • extend - if true, overrides an existing decoration. The method must be a function with the signature function(existing) where:
    • existing - is the previously set decoration method value.
    • must return the new decoration function or value.
    • cannot be used to extend handler decorations.

Return value: none.

const Hapi = require('@hapi/hapi');
const server = Hapi.server({ port: 80 });

const success = function () {

    return this.response({ status: 'ok' });
};

server.decorate('toolkit', 'success', success);

server.route({
    method: 'GET',
    path: '/',
    handler: function (request, h) {

        return h.success();
    }
});

When registering a handler decoration, the method must be a function using the signature function(route, options) where:

• route - the route information.
• options - the configuration object provided in the handler config.

const Hapi = require('@hapi/hapi');

async function example() {

    const server = Hapi.server({ host: 'localhost', port: 8000 });

    // Defines new handler for routes on this server

    const handler = function (route, options) {

        return function (request, h) {

            return 'new handler: ' + options.msg;
        }
    };

    server.decorate('handler', 'test', handler);

    server.route({
        method: 'GET',
        path: '/',
        handler: { test: { msg: 'test' } }
    });

    await server.start();
}

The method function can have a defaults object or function property. If the property is set to an object, that object is used as the default route config for routes using this handler. If the property is set to a function, the function uses the signature function(method) and returns the route default configuration.

const Hapi = require('@hapi/hapi');
const server = Hapi.server({ host: 'localhost', port: 8000 });

const handler = function (route, options) {

    return function (request, h) {

        return 'new handler: ' + options.msg;
    }
};

// Change the default payload processing for this handler

handler.defaults = {
    payload: {
        output: 'stream',
        parse: false
    }
};

server.decorate('handler', 'test', handler);

Used within a plugin to declare a required dependency on other plugins required for the current plugin to operate (plugins listed must be registered before the server is initialized or started) where:

• dependencies - one of:

  • a single plugin name string.
  • an array of plugin name strings.
  • an object where each key is a plugin name and each matching value is a version range string which must match the registered plugin version.

• after - (optional) a function that is called after all the specified dependencies have been registered and before the server starts. The function is only called if the server is initialized or started. The function signature is async function(server) where:

  • server - the server the dependency() method was called on.

Return value: none.

The after method is identical to setting a server extension point on 'onPreStart'.

If a circular dependency is detected, an exception is thrown (e.g. two plugins each has an after function to be called after the other).

const after = function (server) {

    // Additional plugin registration logic
};

exports.plugin = {
    name: 'example',
    register: function (server, options) {

        server.dependency('yar', after);
    }
};

Dependencies can also be set via the plugin dependencies property (does not support setting after):

exports.plugin = {
    name: 'test',
    version: '1.0.0',
    dependencies: {
        yar: '1.x.x'
    },
    register: function (server, options) { }
};

The dependencies configuration accepts one of:

• a single plugin name string.
• an array of plugin name strings.
• an object where each key is a plugin name and each matching value is a version range string which must match the registered plugin version.

Registers a custom content encoding compressor to extend the built-in support for 'gzip' and 'deflate' where:

• encoding - the encoder name string.

• encoder - a function using the signature function(options) where options are the encoding specific options configured in the route compression option, and the return value is an object compatible with the output of node's zlib.createGzip().

Return value: none.

const Zlib = require('zlib');
const Hapi = require('@hapi/hapi');
const server = Hapi.server({ port: 80, routes: { compression: { special: { chunkSize: 16 * 1024 } } } });

server.encoder('special', (options) => Zlib.createGzip(options));

Register custom application events where:

• events - must be one of:

  • an event name string.

  • an event options object with the following optional keys (unless noted otherwise):

    • name - the event name string (required).

    • channels - a string or array of strings specifying the event channels available. Defaults to no channel restrictions (event updates can specify a channel or not).

    • clone - if true, the data object passed to server.events.emit() is cloned before it is passed to the listeners (unless an override specified by each listener). Defaults to false (data is passed as-is).

    • spread - if true, the data object passed to server.event.emit() must be an array and the listener method is called with each array element passed as a separate argument (unless an override specified by each listener). This should only be used when the emitted data structure is known and predictable. Defaults to false (data is emitted as a single argument regardless of its type).

    • tags - if true and the criteria object passed to server.event.emit() includes tags, the tags are mapped to an object (where each tag string is the key and the value is true) which is appended to the arguments list at the end. A configuration override can be set by each listener. Defaults to false.

    • shared - if true, the same event name can be registered multiple times where the second registration is ignored. Note that if the registration config is changed between registrations, only the first configuration is used. Defaults to false (a duplicate registration will throw an error).

  • an array containing any of the above.

Return value: none.

const Hapi = require('@hapi/hapi');

async function example() {

    const server = Hapi.server({ port: 80 });
    server.event('test');
    server.events.on('test', (update) => console.log(update));
    await server.events.gauge('test', 'hello');
}

Emits a custom application event to all the subscribed listeners where:

• criteria - the event update criteria which must be one of:

  • the event name string.
  • an object with the following optional keys (unless noted otherwise):
    • name - the event name string (required).
    • channel - the channel name string.
    • tags - a tag string or array of tag strings.

• data - the value emitted to the subscribers. If data is a function, the function signature is function() and it called once to generate (return value) the actual data emitted to the listeners. If no listeners match the event, the data function is not invoked.

Return value: none.

Note that events must be registered before they can be emitted or subscribed to by calling server.event(events). This is done to detect event name misspelling and invalid event activities.

const Hapi = require('@hapi/hapi');

async function example() {

    const server = Hapi.server({ port: 80 });
    server.event('test');
    server.events.on('test', (update) => console.log(update));
    server.events.emit('test', 'hello');
}

Subscribe to an event where:

• criteria - the subscription criteria which must be one of:

  • event name string which can be any of the built-in server events or a custom application event registered with server.event().

  • a criteria object with the following optional keys (unless noted otherwise):

    • name - (required) the event name string.

    • channels - a string or array of strings specifying the event channels to subscribe to. If the event registration specified a list of allowed channels, the channels array must match the allowed channels. If channels are specified, event updates without any channel designation will not be included in the subscription. Defaults to no channels filter.

    • clone - if true, the data object passed to server.event.emit() is cloned before it is passed to the listener method. Defaults to the event registration option (which defaults to false).

    • count - a positive integer indicating the number of times the listener can be called after which the subscription is automatically removed. A count of 1 is the same as calling server.events.once(). Defaults to no limit.

    • filter - the event tags (if present) to subscribe to which can be one of:

      • a tag string.

      • an array of tag strings.

      • an object with the following:

        • tags - a tag string or array of tag strings.
        • all - if true, all tags must be present for the event update to match the subscription. Defaults to false (at least one matching tag).

    • spread - if true, and the data object passed to server.event.emit() is an array, the listener method is called with each array element passed as a separate argument. This should only be used when the emitted data structure is known and predictable. Defaults to the event registration option (which defaults to false).

    • tags - if true and the criteria object passed to server.event.emit() includes tags, the tags are mapped to an object (where each tag string is the key and the value is true) which is appended to the arguments list at the end. Defaults to the event registration option (which defaults to false).

• listener - the handler method set to receive event updates. The function signature depends on the event argument, and the spread and tags options.

• context - an object that binds to the listener handler.

Return value: none.

const Hapi = require('@hapi/hapi');

async function example() {

    const server = Hapi.server({ port: 80 });
    server.event('test');
    server.events.on('test', (update) => console.log(update));
    server.events.emit('test', 'hello');
}

Same as calling server.events.on() with the count option set to 1.

Return value: none.

const Hapi = require('@hapi/hapi');

async function example() {

    const server = Hapi.server({ port: 80 });
    server.event('test');
    server.events.once('test', (update) => console.log(update));
    server.events.emit('test', 'hello');
    server.events.emit('test', 'hello');       // Ignored
}

Same as calling server.events.on() with the count option set to 1.

Return value: a promise that resolves when the event is emitted.

const Hapi = require('@hapi/hapi');

async function example() {

    const server = Hapi.server({ port: 80 });
    server.event('test');
    const pending = server.events.once('test');
    server.events.emit('test', 'hello');
    const update = await pending;
}

Behaves identically to server.events.emit(), but also returns an array of the results of all the event listeners that run. The return value is that of Promise.allSettled(), where each item in the resulting array is { status: 'fulfilled', value } in the case of a successful handler, or { status: 'rejected', reason } in the case of a handler that throws.

Please note that system errors such as a TypeError are not handled specially, and it's recommended to scrutinize any rejections using something like bounce.

Used within a plugin to expose a property via server.plugins[name] where:

• key - the key assigned (server.plugins[name][key]).
• value - the value assigned.
• options - optional settings:
  • scope - controls how to handle the presence of a plugin scope in the name (e.g. @hapi/test):
    • false - the scope is removed (e.g. @hapi/test is changed to test under server.plugins). This is the default.
    • true - the scope is retained as-is (e.g. @hapi/test is used as server.plugins['@hapi/test']).
    • 'underscore' - the scope is rewritten (e.g. @hapi/test is used as server.plugins.hapi__test).

Return value: none.

exports.plugin =
    name: 'example',
    register: function (server, options) {

        server.expose('util', () => console.log('something'));
    }
};

Merges an object into to the existing content of server.plugins[name] where:

• obj - the object merged into the exposed properties container.

Return value: none.

exports.plugin = {
    name: 'example',
    register: function (server, options) {

        server.expose({ util: () => console.log('something') });
    }
};

Note that all the properties of obj are deeply cloned into server.plugins[name], so avoid using this method for exposing large objects that may be expensive to clone or singleton objects such as database client objects. Instead favor server.expose(key, value), which only copies a reference to value.

Registers an extension function in one of the request lifecycle extension points where:

• events - an object or array of objects with the following:

  • type - (required) the extension point event name. The available extension points include the request extension points as well as the following server extension points:

    • 'onPreStart' - called before the connection listeners are started.
    • 'onPostStart' - called after the connection listeners are started.
    • 'onPreStop' - called before the connection listeners are stopped.
    • 'onPostStop' - called after the connection listeners are stopped.

  • method - (required) a function or an array of functions to be executed at a specified point during request processing. The required extension function signature is:

    • server extension points: async function(server) where:

      • server - the server object.
      • this - the object provided via options.bind or the current active context set with server.bind().

    • request extension points: a lifecycle method.

  • options - (optional) an object with the following:

    • before - a string or array of strings of plugin names this method must execute before (on the same event). Otherwise, extension methods are executed in the order added.

    • after - a string or array of strings of plugin names this method must execute after (on the same event). Otherwise, extension methods are executed in the order added.

    • bind - a context object passed back to the provided method (via this) when called. Ignored if the method is an arrow function.

    • sandbox - if set to 'plugin' when adding a request extension points the extension is only added to routes defined by the current plugin. Not allowed when configuring route-level extensions, or when adding server extensions. Defaults to 'server' which applies to any route added to the server the extension is added to.

    • timeout - number of milliseconds to wait for the method to complete before returning a timeout error. Defaults to no timeout.

Return value: none.

const Hapi = require('@hapi/hapi');

async function example() {

    const server = Hapi.server({ port: 80 });

    server.ext({
        type: 'onRequest',
        method: function (request, h) {

            // Change all requests to '/test'

            request.setUrl('/test');
            return h.continue;
        }
    });

    server.route({ method: 'GET', path: '/test', handler: () => 'ok' });
    await server.start();

    // All requests will get routed to '/test'
}

Registers a single extension event using the same properties as used in server.ext(events), but passed as arguments.

The method may be omitted (if options isn't present) or passed null which will cause the function to return a promise. The promise is resolved with the request object on the first invocation of the extension point. This is primarily used for writing tests without having to write custom handlers just to handle a single event.

Return value: a promise if method is omitted, otherwise undefined.

const Hapi = require('@hapi/hapi');

async function example() {

    const server = Hapi.server({ port: 80 });

    server.ext('onRequest', function (request, h) {

        // Change all requests to '/test'

        request.setUrl('/test');
        return h.continue;
    });

    server.route({ method: 'GET', path: '/test', handler: () => 'ok' });
    await server.start();

    // All requests will get routed to '/test'
}

Initializes the server (starts the caches, finalizes plugin registration) but does not start listening on the connection port.

Return value: none.

Note that if the method fails and throws an error, the server is considered to be in an undefined state and should be shut down. In most cases it would be impossible to fully recover as the various plugins, caches, and other event listeners will get confused by repeated attempts to start the server or make assumptions about the healthy state of the environment. It is recommended to abort the process when the server fails to start properly. If you must try to resume after an error, call server.stop() first to reset the server state.

const Hapi = require('@hapi/hapi');
const Hoek = require('@hapi/hoek');

async function example() {

    const server = Hapi.server({ port: 80 });
    await server.initialize();
}

Injects a request into the server simulating an incoming HTTP request without making an actual socket connection. Injection is useful for testing purposes as well as for invoking routing logic internally without the overhead and limitations of the network stack.

The method utilizes the shot module for performing injections, with some additional options and response properties:

• options - can be assigned a string with the requested URI, or an object with:

  • method - (optional) the request HTTP method (e.g. 'POST'). Defaults to 'GET'.

  • url - (required) the request URL. If the URI includes an authority (e.g. 'example.com:8080'), it is used to automatically set an HTTP 'Host' header, unless one was specified in headers.

  • authority - (optional) a string specifying the HTTP 'Host' header value. Only used if 'Host' is not specified in headers and the url does not include an authority component. Default is inferred from runtime server information.

  • headers - (optional) an object with optional request headers where each key is the header name and the value is the header content. Defaults to no additions to the default shot headers.

  • payload - (optional) an string, buffer or object containing the request payload. In case of an object it will be converted to a string for you. Defaults to no payload. Note that payload processing defaults to 'application/json' if no 'Content-Type' header provided.

  • auth - (optional) an object containing parsed authentication credentials where:

    • strategy - (required) the authentication strategy name matching the provided credentials.

    • credentials - (required) a credentials object containing authentication information. The credentials are used to bypass the default authentication strategies, and are validated directly as if they were received via an authentication scheme.

    • artifacts - (optional) an artifacts object containing authentication artifact information. The artifacts are used to bypass the default authentication strategies, and are validated directly as if they were received via an authentication scheme. Defaults to no artifacts.

    • payload - (optional) disables payload authentication when set to false. Only required when an authentication strategy requires payload authentication. Defaults to true.

  • app - (optional) sets the initial value of request.app, defaults to {}.

  • plugins - (optional) sets the initial value of request.plugins, defaults to {}.

  • allowInternals - (optional) allows access to routes with options.isInternal set to true. Defaults to false.

  • remoteAddress - (optional) sets the remote address for the incoming connection.

  • simulate - (optional) an object with options used to simulate client request stream conditions for testing:

    • error - if true, emits an 'error' event after payload transmission (if any). Defaults to false.

    • close - if true, emits a 'close' event after payload transmission (if any). Defaults to false.

    • end - if false, does not end the stream. Defaults to true.

    • split - indicates whether the request payload will be split into chunks. Defaults to undefined, meaning payload will not be chunked.

  • validate - (optional) if false, the options inputs are not validated. This is recommended for run-time usage of inject() to make it perform faster where input validation can be tested separately.

Return value: a response object with the following properties:

• statusCode - the HTTP status code.

• headers - an object containing the headers set.

• payload - the response payload string.

• rawPayload - the raw response payload buffer.

• raw - an object with the injection request and response objects:

  • req - the simulated node request object.
  • res - the simulated node response object.

• result - the raw handler response (e.g. when not a stream or a view) before it is serialized for transmission. If not available, the value is set to payload. Useful for inspection and reuse of the internal objects returned (instead of parsing the response string).

• request - the request object.

Throws a Boom error if the request processing fails. The partial response object is exposed on the data property.

const Hapi = require('@hapi/hapi');

async function example() {

    const server = Hapi.server({ port: 80 });
    server.route({ method: 'GET', path: '/', handler: () => 'Success!' });

    const res = await server.inject('/');
    console.log(res.result);                // 'Success!'
}

Logs server events that cannot be associated with a specific request. When called the server emits a 'log' event which can be used by other listeners or plugins to record the information or output to the console. The arguments are:

• tags - (required) a string or an array of strings (e.g. ['error', 'database', 'read']) used to identify the event. Tags are used instead of log levels and provide a much more expressive mechanism for describing and filtering events. Any logs generated by the server internally include the 'hapi' tag along with event-specific information.

• data - (optional) an message string or object with the application data being logged. If data is a function, the function signature is function() and it called once to generate (return value) the actual data emitted to the listeners. If no listeners match the event, the data function is not invoked.

• timestamp - (optional) an timestamp expressed in milliseconds. Defaults to Date.now() (now).

Return value: none.

const Hapi = require('@hapi/hapi');
const server = Hapi.server({ port: 80 });

server.events.on('log', (event, tags) => {

    if (tags.error) {
        console.log(event);
    }
});

server.log(['test', 'error'], 'Test event');

Looks up a route configuration where:

• id - the route identifier.

Return value: the route information if found, otherwise null.

const Hapi = require('@hapi/hapi');
const server = Hapi.server();
server.route({
    method: 'GET',
    path: '/',
    options: {
        id: 'root',
        handler: () => 'ok'
    }
});

const route = server.lookup('root');

Looks up a route configuration where:

• method - the HTTP method (e.g. 'GET', 'POST').
• path - the requested path (must begin with '/').
• host - (optional) hostname (to match against routes with vhost).

Return value: the route information if found, otherwise null.

const Hapi = require('@hapi/hapi');
const server = Hapi.server();
server.route({
    method: 'GET',
    path: '/',
    options: {
        id: 'root',
        handler: () => 'ok'
    }
});

const route = server.match('get', '/');

Registers a server method where:

• name - a unique method name used to invoke the method via server.methods[name].

• method - the method function with a signature async function(...args, [flags]) where:

  • ...args - the method function arguments (can be any number of arguments or none).
  • flags - when caching is enabled, an object used to set optional method result flags. This parameter is provided automatically and can only be accessed/modified within the method function. It cannot be passed as an argument.
    • ttl - 0 if result is valid but cannot be cached. Defaults to cache policy.

• options - (optional) configuration object:

  • bind - a context object passed back to the method function (via this) when called. Defaults to active context (set via server.bind() when the method is registered. Ignored if the method is an arrow function.

  • cache - the same cache configuration used in server.cache(). The generateTimeout option is required, and the generateFunc options is not allowed.

  • generateKey - a function used to generate a unique key (for caching) from the arguments passed to the method function (the flags argument is not passed as input). The server will automatically generate a unique key if the function's arguments are all of types 'string', 'number', or 'boolean'. However if the method uses other types of arguments, a key generation function must be provided which takes the same arguments as the function and returns a unique string (or null if no key can be generated).

Return value: none.

Method names can be nested (e.g. utils.users.get) which will automatically create the full path under server.methods (e.g. accessed via server.methods.utils.users.get).

When configured with caching enabled, server.methods[name].cache is assigned an object with the following properties and methods: - await drop(...args) - a function that can be used to clear the cache for a given key. - stats - an object with cache statistics, see catbox for stats documentation.

Simple arguments example:

const Hapi = require('@hapi/hapi');

async function example() {

    const server = Hapi.server({ port: 80 });

    const add = (a, b) => (a + b);
    server.method('sum', add, { cache: { expiresIn: 2000, generateTimeout: 100 } });

    console.log(await server.methods.sum(4, 5));          // 9
}

Object argument example:

const Hapi = require('@hapi/hapi');

async function example() {

    const server = Hapi.server({ port: 80 });

    const addArray = function (array) {

        let sum = 0;
        array.forEach((item) => {

            sum += item;
        });

        return sum;
    };

    const options = {
        cache: { expiresIn: 2000, generateTimeout: 100 },
        generateKey: (array) => array.join(',')
    };

    server.method('sumObj', addArray, options);

    console.log(await server.methods.sumObj([5, 6]));     // 11
}

Registers a server method function as described in server.method() using a configuration object where:

• methods - an object or an array of objects where each one contains:

  • name - the method name.
  • method - the method function.
  • options - (optional) settings.

Return value: none.

const add = function (a, b) {

    return a + b;
};

server.method({
    name: 'sum',
    method: add,
    options: {
        cache: {
            expiresIn: 2000,
            generateTimeout: 100
        }
    }
});

Sets the path prefix used to locate static resources (files and view templates) when relative paths are used where:

• relativeTo - the path prefix added to any relative file path starting with '.'.

Return value: none.

Note that setting a path within a plugin only applies to resources accessed by plugin methods. If no path is set, the server default route configuration files.relativeTo settings is used. The path only applies to routes added after it has been set.

exports.plugin = {
    name: 'example',
    register: function (server, options) {

        // Assuming the Inert plugin was registered previously

        server.path(__dirname + '../static');
        server.route({ path: '/file', method: 'GET', handler: { file: './test.html' } });
    }
};

Registers a plugin where:

• plugins - one or an array of:

  • a plugin object.

  • an object with the following:

    • plugin - a plugin object.
    • options - (optional) options passed to the plugin during registration.
    • once, routes - (optional) plugin-specific registration options as defined below.

• options - (optional) registration options (different from the options passed to the registration function):

  • once - if true, subsequent registrations of the same plugin are skipped without error. Cannot be used with plugin options. Defaults to false. If not set to true, an error will be thrown the second time a plugin is registered on the server.

  • routes - modifiers applied to each route added by the plugin:

    • prefix - string added as prefix to any route path (must begin with '/'). If a plugin registers a child plugin the prefix is passed on to the child or is added in front of the child-specific prefix.
    • vhost - virtual host string (or array of strings) applied to every route. The outer-most vhost overrides the any nested configuration.

Return value: a reference to the server.

async function example() {

    await server.register({ plugin: require('plugin_name'), options: { message: 'hello' } });
}

Adds a route where:

• route - a route configuration object or an array of configuration objects where each object contains:

  • path - (required) the absolute path used to match incoming requests (must begin with '/'). Incoming requests are compared to the configured paths based on the server's router configuration. The path can include named parameters enclosed in {} which will be matched against literal values in the request as described in Path parameters.

  • method - (required) the HTTP method. Typically one of 'GET', 'POST', 'PUT', 'PATCH', 'DELETE', or 'OPTIONS'. Any HTTP method is allowed, except for 'HEAD'. Use '*' to match against any HTTP method (only when an exact match was not found, and any match with a specific method will be given a higher priority over a wildcard match). Can be assigned an array of methods which has the same result as adding the same route with different methods manually.

  • vhost - (optional) a domain string or an array of domain strings for limiting the route to only requests with a matching host header field. Matching is done against the hostname part of the header only (excluding the port). Defaults to all hosts.

  • handler - (required when handler is not set) the route handler function called to generate the response after successful authentication and validation.

  • options - additional route options. The options value can be an object or a function that returns an object using the signature function(server) where server is the server the route is being added to and this is bound to the current realm's bind option.

  • rules - route custom rules object. The object is passed to each rules processor registered with server.rules(). Cannot be used if route.options.rules is defined.

Return value: none.

Note that the options object is deeply cloned (with the exception of bind which is shallowly copied) and cannot contain any values that are unsafe to perform deep copy on.

const Hapi = require('@hapi/hapi');
const server = Hapi.server({ port: 80 });

// Handler in top level

server.route({ method: 'GET', path: '/status', handler: () => 'ok' });

// Handler in config

const user = {
    cache: { expiresIn: 5000 },
    handler: function (request, h) {

        return { name: 'John' };
    }
};

server.route({ method: 'GET', path: '/user', options: user });

// An array of routes

server.route([
    { method: 'GET', path: '/1', handler: function (request, h) { return 'ok'; } },
    { method: 'GET', path: '/2', handler: function (request, h) { return 'ok'; } }
]);

Parameterized paths are processed by matching the named parameters to the content of the incoming request path at that path segment. For example, '/book/{id}/cover' will match '/book/123/cover' and request.params.id will be set to '123'. Each path segment (everything between the opening '/' and the closing '/' unless it is the end of the path) can only include one named parameter. A parameter can cover the entire segment ('/{param}') or part of the segment ('/file.{ext}'). A path parameter may only contain letters, numbers and underscores, e.g. '/{file-name}' is invalid and '/{file_name}' is valid.

An optional '?' suffix following the parameter name indicates an optional parameter (only allowed if the parameter is at the ends of the path or only covers part of the segment as in '/a{param?}/b'). For example, the route '/book/{id?}' matches '/book/' with the value of request.params.id set to an empty string ''.

const Hapi = require('@hapi/hapi');
const server = Hapi.server({ port: 80 });

const getAlbum = function (request, h) {

    return 'You asked for ' +
        (request.params.song ? request.params.song + ' from ' : '') +
        request.params.album;
};

server.route({
    path: '/{album}/{song?}',
    method: 'GET',
    handler: getAlbum
});

In addition to the optional ? suffix, a parameter name can also specify the number of matching segments using the * suffix, followed by a number greater than 1. If the number of expected parts can be anything, then use * without a number (matching any number of segments can only be used in the last path segment).

const Hapi = require('@hapi/hapi');
const server = Hapi.server({ port: 80 });

const getPerson = function (request, h) {

    const nameParts = request.params.name.split('/');
    return { first: nameParts[0], last: nameParts[1] };
};

server.route({
    path: '/person/{name*2}',   // Matches '/person/john/doe'
    method: 'GET',
    handler: getPerson
});

The router iterates through the routing table on each incoming request and executes the first (and only the first) matching route. Route matching is done based on the combination of the request path and the HTTP verb (e.g. 'GET, 'POST'). The query is excluded from the routing logic. Requests are matched in a deterministic order where the order in which routes are added does not matter.

Routes are matched based on the specificity of the route which is evaluated at each segment of the incoming request path. Each request path is split into its segment (the parts separated by '/'). The segments are compared to the routing table one at a time and are matched against the most specific path until a match is found. If no match is found, the next match is tried.

When matching routes, string literals (no path parameter) have the highest priority, followed by mixed parameters ('/a{p}b'), parameters ('/{p}'), and then wildcard (/{p*}).

Note that mixed parameters are slower to compare as they cannot be hashed and require an array iteration over all the regular expressions representing the various mixed parameter at each routing table node.

If the application needs to override the default Not Found (404) error response, it can add a catch-all route for a specific method or all methods. Only one catch-all route can be defined.

const Hapi = require('@hapi/hapi');
const server = Hapi.server({ port: 80 });

const handler = function (request, h) {

    return h.response('The page was not found').code(404);
};

server.route({ method: '*', path: '/{p*}', handler });

Defines a route rules processor for converting route rules object into route configuration where:

• processor - a function using the signature function(rules, info) where:

  • rules - the custom object defined in your routes configuration for you to use its values.
  • info - an object with the following properties:
    • method - the route method.
    • path - the route path.
    • vhost - the route virtual host (if any defined).
  • returns a route config object.

• options - optional settings:

  • validate - rules object validation:
    • schema - joi schema.
    • options - optional joi validation options. Defaults to { allowUnknown: true }.

Note that the root server and each plugin server instance can only register one rules processor. If a route is added after the rules are configured, it will not include the rules config. Routes added by plugins apply the rules to each of the parent realms' rules from the root to the route's realm. This means the processor defined by the plugin overrides the config generated by the root processor if they overlap. Similarly, the route's own config overrides the config produced by the rules processors.

const validateSchema = {
    auth: Joi.string(),
    myCustomPre: Joi.array().min(2).items(Joi.string()),
    payload: Joi.object()
};

const myPreHelper = (name) => {

    return {
        method: (request, h) => {

            return `hello ${name || 'world'}!`;
        },
        assign: 'myPreHelper'
    };
};

const processor = (rules, info) => {

    if (!rules) {
        return null;
    }

    const options = {};

    if (rules.auth) {
        options.auth = {
            strategy: rules.auth,
            validate: {
                entity: 'user'
            }
        };
    }

    if (rules.myCustomPre) {
        options.pre = [
            myPreHelper(...rules.myCustomPre)
        ];
    }

    if (rules.payload) {
        options.validate = { payload: Joi.object(rules.payload) };
    }

    return options;
};

server.rules(processor, {
    validate: { schema: validateSchema }
});

server.route({
    method: 'GET',
    path: '/',
    rules: {
        auth: 'jwt',
        myCustomPre: ['arg1', 'arg2'],
        payload: { a: Joi.boolean(), b: Joi.string() }
    },
    options: {
        id: 'my-route'
    }
});

Starts the server by listening for incoming requests on the configured port (unless the connection was configured with autoListen set to false).

Return value: none.

Note that if the method fails and throws an error, the server is considered to be in an undefined state and should be shut down. In most cases it would be impossible to fully recover as the various plugins, caches, and other event listeners will get confused by repeated attempts to start the server or make assumptions about the healthy state of the environment. It is recommended to abort the process when the server fails to start properly. If you must try to resume after an error, call server.stop() first to reset the server state.

If a started server is started again, the second call to server.start() is ignored. No events will be emitted and no extension points invoked.

const Hapi = require('@hapi/hapi');

async function example() {

    const server = Hapi.server({ port: 80 });
    await server.start();
    console.log('Server started at: ' + server.info.uri);
}

HTTP state management uses client cookies to persist a state across multiple requests. Registers a cookie definitions where:

• name - the cookie name string.

• options - are the optional cookie settings:

  • ttl - time-to-live in milliseconds. Defaults to null (session time-life - cookies are deleted when the browser is closed).

  • isSecure - sets the 'Secure' flag. Defaults to true.

  • isHttpOnly - sets the 'HttpOnly' flag. Defaults to true.

  • isSameSite - sets the 'SameSite' flag. The value must be one of:

    • false - no flag.
    • 'Strict' - sets the value to 'Strict' (this is the default value).
    • 'Lax' - sets the value to 'Lax'.
    • 'None' - sets the value to 'None'.

  • path - the path scope. Defaults to null (no path).

  • domain - the domain scope. Defaults to null (no domain).

  • autoValue - if present and the cookie was not received from the client or explicitly set by the route handler, the cookie is automatically added to the response with the provided value. The value can be a function with signature async function(request) where:

    • request - the request object.

  • encoding - encoding performs on the provided value before serialization. Options are:

    • 'none' - no encoding. When used, the cookie value must be a string. This is the default value.
    • 'base64' - string value is encoded using Base64.
    • 'base64json' - object value is JSON-stringified then encoded using Base64.
    • 'form' - object value is encoded using the x-www-form-urlencoded method.
    • 'iron' - Encrypts and sign the value using iron.

  • sign - an object used to calculate an HMAC for cookie integrity validation. This does not provide privacy, only a mean to verify that the cookie value was generated by the server. Redundant when 'iron' encoding is used. Options are:

    • integrity - algorithm options. Defaults to require('iron').defaults.integrity.
    • password - password used for HMAC key generation (must be at least 32 characters long).

  • password - password used for 'iron' encoding (must be at least 32 characters long).

  • iron - options for 'iron' encoding. Defaults to require('iron').defaults.

  • ignoreErrors - if true, errors are ignored and treated as missing cookies.

  • clearInvalid - if true, automatically instruct the client to remove invalid cookies. Defaults to false.

  • strictHeader - if false, allows any cookie value including values in violation of RFC 6265. Defaults to true.

  • passThrough - used by proxy plugins (e.g. h2o2).

  • contextualize - a function using the signature async function(definition, request) used to override a request-specific cookie settings where:

    • definition - a copy of the options to be used for formatting the cookie that can be manipulated by the function to customize the request cookie header. Note that changing the definition.contextualize property will be ignored.
    • request - the current request object.

Return value: none.

State defaults can be modified via the server.options.state configuration option.

const Hapi = require('@hapi/hapi');
const server = Hapi.server({ port: 80 });

// Set cookie definition

server.state('session', {
    ttl: 24 * 60 * 60 * 1000,     // One day
    isSecure: true,
    path: '/',
    encoding: 'base64json'
});

// Set state in route handler

const handler = function (request, h) {

    let session = request.state.session;
    if (!session) {
        session = { user: 'joe' };
    }

    session.last = Date.now();

    return h.response('Success').state('session', session);
};

Registered cookies are automatically parsed when received. Parsing rules depends on the route state.parse configuration. If an incoming registered cookie fails parsing, it is not included in request.state, regardless of the state.failAction setting. When state.failAction is set to 'log' and an invalid cookie value is received, the server will emit a 'request' event. To capture these errors subscribe to the 'request' event on the 'internal' channel and filter on 'error' and 'state' tags:

const Hapi = require('@hapi/hapi');
const server = Hapi.server({ port: 80 });

server.events.on({ name: 'request', channels: 'internal' }, (request, event, tags) => {

    if (tags.error && tags.state) {
        console.error(event);
    }
});

Access: read only.

Same as calling server.state().

Formats an HTTP 'Set-Cookie' header based on the server.options.state where:

• cookies - a single object or an array of object where each contains:
  • name - the cookie name.
  • value - the cookie value.
  • options - cookie configuration to override the server settings.

Return value: a header string.

Note that this utility uses the server configuration but does not change the server state. It is provided for manual cookie formatting (e.g. when headers are set manually).

Parses an HTTP 'Cookies' header based on the server.options.state where:

• header - the HTTP header.

Return value: an object where each key is a cookie name and value is the parsed cookie.

Note that this utility uses the server configuration but does not change the server state. It is provided for manual cookie parsing (e.g. when server parsing is disabled).

Stops the server's listener by refusing to accept any new connections or requests (existing connections will continue until closed or timeout), where:

• options - (optional) object with:

  • timeout - sets the timeout in millisecond before forcefully terminating any open connections that arrived before the server stopped accepting new connections. The timeout only applies to waiting for existing connections to close, and not to any 'onPreStop' or 'onPostStop' server extensions which can delay or block the stop operation indefinitely. Ignored if server.options.operations.cleanStop is false. Note that if the server is set as a group controller, the timeout is per controlled server and the controlling server itself. Defaults to 5000 (5 seconds).

Return value: none.

const Hapi = require('@hapi/hapi');

async function example() {

    const server = Hapi.server({ port: 80 });
    await server.start();
    await server.stop({ timeout: 60 * 1000 });
    console.log('Server stopped');
}

Returns a copy of the routing table where:

• host - (optional) host to filter routes matching a specific virtual host. Defaults to all virtual hosts.

Return value: an array of routes where each route contains:

• settings - the route config with defaults applied.
• method - the HTTP method in lower case.
• path - the route path.

const Hapi = require('@hapi/hapi');
const server = Hapi.server({ port: 80 });
server.route({ method: 'GET', path: '/example', handler: () => 'ok' });

const table = server.table();