# Feature catalog — koajs/koa

> Canonical page: https://codevetter.com/unpack/koa/feature-catalog

# Feature catalog — koajs/koa

Scanned commit 824c1cf8de9a91a2941973b25dc8a3d3029b9e4f (2026-09-18). Generated by codevetter codevetter 1.15.0 on 2026-10-02.

Source inspection; upstream code and tests were not executed.

Koa's user-facing surface is a developer API for composing HTTP behavior. Request helpers interpret URLs and headers, while response helpers construct and transmit representations. Cookies, errors, and current-context access complement that core; the documented framework leaves routing to middleware.
- app.use(fn) validates functions and supports chaining; async or promise-returning middleware can await next() and modify the response during upstream unwinding. — [lib/application.js#L167-171](https://github.com/koajs/koa/blob/824c1cf8de9a91a2941973b25dc8a3d3029b9e4f/lib/application.js#L167-L171) [Readme.md#L54-77](https://github.com/koajs/koa/blob/824c1cf8de9a91a2941973b25dc8a3d3029b9e4f/Readme.md#L54-L77)
- Request APIs expose mutable method, URL, path, query, querystring, and search, alongside original-URL-based href and memoized WHATWG URL. — [lib/request.js#L109-113](https://github.com/koajs/koa/blob/824c1cf8de9a91a2941973b25dc8a3d3029b9e4f/lib/request.js#L109-L113) [lib/request.js#L122-163](https://github.com/koajs/koa/blob/824c1cf8de9a91a2941973b25dc8a3d3029b9e4f/lib/request.js#L122-L163) [lib/request.js#L172-239](https://github.com/koajs/koa/blob/824c1cf8de9a91a2941973b25dc8a3d3029b9e4f/lib/request.js#L172-L239) [lib/request.js#L296-308](https://github.com/koajs/koa/blob/824c1cf8de9a91a2941973b25dc8a3d3029b9e4f/lib/request.js#L296-L308)
- accepts(), acceptsEncodings(), acceptsCharsets(), and acceptsLanguages() negotiate headers through accepts; is(), type, charset, and length interpret request content metadata. — [lib/request.js#L378-398](https://github.com/koajs/koa/blob/824c1cf8de9a91a2941973b25dc8a3d3029b9e4f/lib/request.js#L378-L398) [lib/request.js#L567-619](https://github.com/koajs/koa/blob/824c1cf8de9a91a2941973b25dc8a3d3029b9e4f/lib/request.js#L567-L619) [lib/request.js#L649-665](https://github.com/koajs/koa/blob/824c1cf8de9a91a2941973b25dc8a3d3029b9e4f/lib/request.js#L649-L665)
- host/hostname, protocol/secure, ips/ip, and subdomains provide proxy-aware request identity; fresh/stale evaluate conditional GET or HEAD requests against outgoing validators. — [lib/request.js#L251-285](https://github.com/koajs/koa/blob/824c1cf8de9a91a2941973b25dc8a3d3029b9e4f/lib/request.js#L251-L285) [lib/request.js#L320-345](https://github.com/koajs/koa/blob/824c1cf8de9a91a2941973b25dc8a3d3029b9e4f/lib/request.js#L320-L345) [lib/request.js#L413-474](https://github.com/koajs/koa/blob/824c1cf8de9a91a2941973b25dc8a3d3029b9e4f/lib/request.js#L413-L474) [lib/request.js#L493-500](https://github.com/koajs/koa/blob/824c1cf8de9a91a2941973b25dc8a3d3029b9e4f/lib/request.js#L493-L500)
- Response bodies accept strings, buffers, JSON values, Node streams, ReadableStream, Blob, and Response, with type/status/length handling and HEAD or empty-status suppression. — [lib/response.js#L135-232](https://github.com/koajs/koa/blob/824c1cf8de9a91a2941973b25dc8a3d3029b9e4f/lib/response.js#L135-L232) [lib/application.js#L295-306](https://github.com/koajs/koa/blob/824c1cf8de9a91a2941973b25dc8a3d3029b9e4f/lib/application.js#L295-L306) [lib/application.js#L331-351](https://github.com/koajs/koa/blob/824c1cf8de9a91a2941973b25dc8a3d3029b9e4f/lib/application.js#L331-L351)
- Response helpers implement redirect(), back(), attachment(), MIME type assignment, ETag/Last-Modified, Vary, header get/set/append/remove, and flushHeaders(). — [lib/response.js#L302-367](https://github.com/koajs/koa/blob/824c1cf8de9a91a2941973b25dc8a3d3029b9e4f/lib/response.js#L302-L367) [lib/response.js#L386-447](https://github.com/koajs/koa/blob/824c1cf8de9a91a2941973b25dc8a3d3029b9e4f/lib/response.js#L386-L447) [lib/response.js#L537-588](https://github.com/koajs/koa/blob/824c1cf8de9a91a2941973b25dc8a3d3029b9e4f/lib/response.js#L537-L588) [lib/response.js#L648-649](https://github.com/koajs/koa/blob/824c1cf8de9a91a2941973b25dc8a3d3029b9e4f/lib/response.js#L648-L649)
- ctx.cookies exposes get/set options including signing and security attributes; ctx.throw/ctx.assert and exported createHttpError/HttpError/isHttpError supply HTTP error utilities. — [docs/api/context.md#L69-93](https://github.com/koajs/koa/blob/824c1cf8de9a91a2941973b25dc8a3d3029b9e4f/docs/api/context.md#L69-L93) [lib/context.js#L72-96](https://github.com/koajs/koa/blob/824c1cf8de9a91a2941973b25dc8a3d3029b9e4f/lib/context.js#L72-L96) [lib/context.js#L164-175](https://github.com/koajs/koa/blob/824c1cf8de9a91a2941973b25dc8a3d3029b9e4f/lib/context.js#L164-L175) [lib/application.js#L354-360](https://github.com/koajs/koa/blob/824c1cf8de9a91a2941973b25dc8a3d3029b9e4f/lib/application.js#L354-L360)
- app.currentContext exposes the current request when AsyncLocalStorage is enabled; raw response handling can be selected with ctx.respond=false, while routing is explicitly external middleware. — [lib/application.js#L187-204](https://github.com/koajs/koa/blob/824c1cf8de9a91a2941973b25dc8a3d3029b9e4f/lib/application.js#L187-L204) [lib/application.js#L283-285](https://github.com/koajs/koa/blob/824c1cf8de9a91a2941973b25dc8a3d3029b9e4f/lib/application.js#L283-L285) [docs/api/context.md#L142-146](https://github.com/koajs/koa/blob/824c1cf8de9a91a2941973b25dc8a3d3029b9e4f/docs/api/context.md#L142-L146) [docs/faq.md#L23-26](https://github.com/koajs/koa/blob/824c1cf8de9a91a2941973b25dc8a3d3029b9e4f/docs/faq.md#L23-L26)

Every claim links to its cited files at the pinned commit. Citations identify source evidence; they do not establish runtime correctness. Independent CodeVetter scan — not reviewed by upstream maintainers.

## Public product links

- [CodeVetter](https://codevetter.com/)
- [Download](https://codevetter.com/download)
- [Documentation](https://codevetter.com/docs/)
- [Source](https://github.com/Codevetter/codevetter)