Malachi.Console.Router (malachi v0.22.7)

View Source

The console endpoint's request pipeline, in the order a request meets it:

  1. Header budget. Bandit already bounds the header count and each header's length; the bytes of names plus values across all headers are bounded here, from the same setting the dashboard enforces (Malachi.HTTP.Limits), and past it the answer is the dashboard's 431 problem.
  2. Security headers. The dashboard's set, from Malachi.Dashboard.SecurityHeaders.headers/3, including its configurable CSP. CORS is left out: it belongs to the dashboard's API routes.
  3. API. A path under /api/v1 goes to Malachi.Console.Api, which authorizes it through Malachi.Console.Access and answers every error as application/problem+json. It is matched before the static steps, because the single page application fallback answers any extensionless path with index.html.
  4. Method. GET and HEAD only; anything else is 405 with Allow.
  5. Bundle. With no bundle built into the release, 503 saying so, never cached.
  6. Static. Malachi.Console.Static answers everything else from the manifest.

Nothing in this module touches the filesystem.

Summary

Types

opts()

What the endpoint hands the router at start: the manifest and the header byte budget.

Types

opts()

@type opts() :: %{
  manifest: Malachi.Console.Assets.t(),
  max_header_bytes: pos_integer()
}

What the endpoint hands the router at start: the manifest and the header byte budget.