fastify · mcollina · May 21, 2025 · May 20, 2025 · May 21, 2025
diff --git a/README.md b/README.md
@@ -233,6 +233,14 @@ are applied for getting the file list.
 
 This option cannot be `false` if `redirect` is `true` and `ignoreTrailingSlash` is `true`.
 
+#### `globIgnore`
+
+Default: `undefined`
+
+This is passed to [`glob`](https://www.npmjs.com/package/glob)
+as the `ignore` option. It can be used to ignore files or directories
+when using the `wildcard: false` option.
+
 #### `allowedPath`
 
 Default: `(pathName, root, request) => true`

diff --git a/index.js b/index.js
@@ -1,4 +1,4 @@
-'use strict'
+'unse strict'
 
 const path = require('node:path')
 const { fileURLToPath } = require('node:url')
@@ -135,7 +135,7 @@ async function fastifyStatic (fastify, opts) {
         rootPath = rootPath.split(path.win32.sep).join(path.posix.sep)
         !rootPath.endsWith('/') && (rootPath += '/')
         const files = await glob('**/**', {
-          cwd: rootPath, absolute: false, follow: true, nodir: true, dot: opts.serveDotFiles
+          cwd: rootPath, absolute: false, follow: true, nodir: true, dot: opts.serveDotFiles, ignore: opts.globIgnore
         })
 
         for (let file of files) {

diff --git a/test/static-filtered/bar.private b/test/static-filtered/bar.private
@@ -0,0 +1 @@
+bar
diff --git a/test/static-filtered/deep/path/to/baz.html b/test/static-filtered/deep/path/to/baz.html
@@ -0,0 +1,3 @@
+<html>
+  <body>baz</body>
+</html>
diff --git a/test/static-filtered/deep/path/to/baz.private b/test/static-filtered/deep/path/to/baz.private
@@ -0,0 +1 @@
+baz
diff --git a/test/static-filtered/index.html b/test/static-filtered/index.html
@@ -0,0 +1,3 @@
+<html>
+  <body>index2</body>
+</html>
diff --git a/test/static.test.js b/test/static.test.js
@@ -3669,3 +3669,77 @@ test('register /static/ with custom log level', async t => {
     t.assert.deepStrictEqual(response2.status, 304)
   })
 })
+
+test('register with wildcard false and globIgnore', async t => {
+  t.plan(5)
+
+  const indexContent = fs
+    .readFileSync('./test/static-filtered/index.html')
+    .toString('utf8')
+
+  const deepContent = fs
+    .readFileSync('./test/static-filtered/deep/path/to/baz.html')
+    .toString('utf8')
+
+  const pluginOptions = {
+    root: path.join(__dirname, '/static-filtered'),
+    wildcard: false,
+    globIgnore: ['**/*.private']
+  }
+  const fastify = Fastify()
+  fastify.register(fastifyStatic, pluginOptions)
+
+  t.after(() => fastify.close())
+
+  await fastify.listen({ port: 0 })
+
+  fastify.server.unref()
+
+  await t.test('/index.html', async t => {
+    t.plan(3 + GENERIC_RESPONSE_CHECK_COUNT)
+
+    const response = await fetch('http://localhost:' + fastify.server.address().port + '/index.html')
+    t.assert.ok(response.ok)
+    t.assert.deepStrictEqual(response.status, 200)
+    t.assert.deepStrictEqual(await response.text(), indexContent)
+    genericResponseChecks(t, response)
+  })
+
+  await t.test('/bar.private', async t => {
+    t.plan(2)
+
+    const response = await fetch('http://localhost:' + fastify.server.address().port + '/bar.private')
+    t.assert.ok(!response.ok)
+    t.assert.deepStrictEqual(response.status, 404)
+    await response.text()
+  })
+
+  await t.test('/', async (t) => {
+    t.plan(3 + GENERIC_RESPONSE_CHECK_COUNT)
+
+    const response = await fetch('http://localhost:' + fastify.server.address().port)
+    t.assert.ok(response.ok)
+    t.assert.deepStrictEqual(response.status, 200)
+    t.assert.deepStrictEqual(await response.text(), indexContent)
+    genericResponseChecks(t, response)
+  })
+
+  await t.test('/deep/path/to/baz.html', async (t) => {
+    t.plan(3 + GENERIC_RESPONSE_CHECK_COUNT)
+
+    const response = await fetch('http://localhost:' + fastify.server.address().port + '/deep/path/to/baz.html')
+    t.assert.ok(response.ok)
+    t.assert.deepStrictEqual(response.status, 200)
+    t.assert.deepStrictEqual(await response.text(), deepContent)
+    genericResponseChecks(t, response)
+  })
+
+  await t.test('/deep/path/to/baz.private', async (t) => {
+    t.plan(2)
+
+    const response = await fetch('http://localhost:' + fastify.server.address().port + '/deep/path/to/baz.private')
+    t.assert.ok(!response.ok)
+    t.assert.deepStrictEqual(response.status, 404)
+    await response.text()
+  })
+})
diff --git a/types/index.d.ts b/types/index.d.ts
@@ -94,6 +94,7 @@ declare namespace fastifyStatic {
     setHeaders?: (res: SetHeadersResponse, path: string, stat: Stats) => void;
     redirect?: boolean;
     wildcard?: boolean;
+    globIgnore?: string[];
     list?: boolean | ListOptionsJsonFormat | ListOptionsHtmlFormat;
     allowedPath?: (pathName: string, root: string, request: FastifyRequest) => boolean;
     /**

diff --git a/types/index.test-d.ts b/types/index.test-d.ts
@@ -50,6 +50,7 @@ const options: FastifyStaticOptions = {
   schemaHide: true,
   serve: true,
   wildcard: true,
+  globIgnore: ['**/*.private'],
   list: false,
   setHeaders: (res, path, stat) => {
     expectType<string>(res.filename)