feat(response): new setting strict status codes

test: test for status in range with strictt status

refactor: default strict status codes to true

History.md

@@ -1,11 +1,13 @@
 unreleased
 =========================
-* remove: 
+* remove:
   - `path-is-absolute` dependency - use `path.isAbsolute` instead
 * breaking:
-  * `res.status()` accepts only integers, and input must be greater than 99 and less than 1000
-    * will throw a `RangeError: Invalid status code: ${code}. Status code must be greater than 99 and less than 1000.` for inputs outside this range
-    * will throw a `TypeError: Invalid status code: ${code}. Status code must be an integer.` for non integer inputs
+  * By default `res.status()` accepts only integers, and input must be greater than 99 and less than 600
+    * Will throw a `RangeError: Invalid status code: ${code}. Status code must be greater than 99 and less than 600 in strict status codes.` for inputs outside this range.
+    * Will throw a `TypeError: Invalid status code: ${code}. Status code must be an integer.` for non integer inputs.
+  * Added a new default setting `strict status codes`, with a default value of true.
+    * When the variable `strict status codes` is set to false, `res.status()` will throw a `RangeError: Invalid status code: ${code}. Status code must be greater than 99 and less than 1000.` for inputs outside this range.
   * deps: send@1.0.0
 * change:
   - `res.clearCookie` will ignore user provided `maxAge` and `expires` options

lib/application.js

@@ -99,6 +99,7 @@ app.defaultConfiguration = function defaultConfiguration() {
   this.set('query parser', 'simple')
   this.set('subdomain offset', 2);
   this.set('trust proxy', false);
+  this.set('strict status codes', true);
 
   // trust proxy inherit back-compat
   Object.defineProperty(this.settings, trustProxyDefaultSymbol, {

lib/response.js

@@ -73,6 +73,12 @@ res.status = function status(code) {
   if (!Number.isInteger(code)) {
     throw new TypeError(`Invalid status code: ${JSON.stringify(code)}. Status code must be an integer.`);
   }
+
+  // Check if the status code is outside of strict status codes valid range
+  if (this.app.get('strict status codes') === true && (code < 100 || code > 599)) {
+    throw new RangeError(`Invalid status code: ${JSON.stringify(code)}. Status code must be greater than 99 and less than 600 in strict status codes.`);
+  }
+
   // Check if the status code is outside of Node's valid range
   if (code < 100 || code > 999) {
     throw new RangeError(`Invalid status code: ${JSON.stringify(code)}. Status code must be greater than 99 and less than 1000.`);

test/res.status.js

@@ -82,6 +82,8 @@ describe('res', function () {
       it('should set the response status code to 700', function (done) {
         var app = express()
 
+        app.set('strict status codes', false)
+
         app.use(function (req, res) {
           res.status(700).end()
         })
@@ -94,6 +96,8 @@ describe('res', function () {
       it('should set the response status code to 800', function (done) {
         var app = express()
 
+        app.set('strict status codes', false)
+
         app.use(function (req, res) {
           res.status(800).end()
         })
@@ -106,6 +110,8 @@ describe('res', function () {
       it('should set the response status code to 900', function (done) {
         var app = express()
 
+        app.set('strict status codes', false)
+
         app.use(function (req, res) {
           res.status(900).end()
         })
@@ -129,9 +135,23 @@ describe('res', function () {
           .expect(500, /Invalid status code/, done);
       });
 
+      it('should raise error for status code above 599', function (done) {
+        var app = express();
+
+        app.use(function (req, res) {
+          res.status(600).end();
+        });
+
+        request(app)
+          .get('/')
+          .expect(500, /Status code must be greater than 99 and less than 600./, done);
+      });
+
       it('should raise error for status code above 999', function (done) {
         var app = express();
 
+        app.set('strict status codes', false);
+
         app.use(function (req, res) {
           res.status(1000).end();
         });