fix(request-id): validation accepts = (#4478)

ryuapp · web-flow · commit 52161170e832 · 2025-10-24T14:17:58.000+09:00
diff --git a/src/middleware/request-id/index.test.ts b/src/middleware/request-id/index.test.ts
@@ -29,6 +29,19 @@ describe('Request ID Middleware', () => {
     expect(await res.text()).toBe('hono-is-hot')
   })
 
+  it('Should return custom request id with all valid characters', async () => {
+    const validRequestId = 'abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789-_='
+    const res = await app.request('http://localhost/requestId', {
+      headers: {
+        'X-Request-Id': validRequestId,
+      },
+    })
+    expect(res).not.toBeNull()
+    expect(res.status).toBe(200)
+    expect(res.headers.get('X-Request-Id')).toBe(validRequestId)
+    expect(await res.text()).toBe(validRequestId)
+  })
+
   it('Should return random request id without using request header', async () => {
     const res = await app.request('http://localhost/requestId', {
       headers: {
diff --git a/src/middleware/request-id/request-id.ts b/src/middleware/request-id/request-id.ts
@@ -46,7 +46,7 @@ export const requestId = ({
   return async function requestId(c, next) {
     // If `headerName` is empty string, req.header will return the object
     let reqId = headerName ? c.req.header(headerName) : undefined
-    if (!reqId || reqId.length > limitLength || /[^\w\-]/.test(reqId)) {
+    if (!reqId || reqId.length > limitLength || /[^\w\-=]/.test(reqId)) {
       reqId = generator(c)
     }
 

Original file line number	Diff line number	Diff line change
`@@ -46,7 +46,7 @@ export const requestId = ({`
`46`	`46`	`return async function requestId(c, next) {`
`47`	`47`	// If `headerName` is empty string, req.header will return the object
`48`	`48`	`let reqId = headerName ? c.req.header(headerName) : undefined`
`49`		`- if (!reqId \|\| reqId.length > limitLength \|\| /[^\w\-]/.test(reqId)) {`
	`49`	`+ if (!reqId \|\| reqId.length > limitLength \|\| /[^\w\-=]/.test(reqId)) {`
`50`	`50`	`reqId = generator(c)`
`51`	`51`	`}`
`52`	`52`