Documentation
¶
Overview ¶
Package origin enforces the browser's same-origin resource boundary for every response served by yomihon's loopback reading site.
It answers two more questions asked at the same edge, for the same reason — both are read off the request and neither belongs to any one face. Which language the interface speaks for this request, which the reader chooses and every page and every sentence then follows; and whether a write that failed partway through a response is a fault worth an operator's attention or a reader who closed the tab, which decides how loudly it is logged.
Index ¶
- func Language(r *http.Request) wording.Lang
- func LoopbackOnly(next http.Handler) http.Handler
- func Nonce(ctx context.Context) string
- func Protect(next http.Handler) http.Handler
- func SetContentSecurityPolicy(ctx context.Context, w http.ResponseWriter, policy string) bool
- func WriteFailureLevel(r *http.Request, err error) slog.Level
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
func Language ¶ added in v0.2.0
Language reads which language this request asked the interface to speak, falling back to the default when the reader has chosen none or has sent a value the dictionary does not know.
func LoopbackOnly ¶ added in v0.2.0
LoopbackOnly refuses any request whose Host names something other than this machine's loopback. Binding the listener to 127.0.0.1 keeps other machines out but not other names: a page whose own domain re-answers as 127.0.0.1 would otherwise reach yomihon with the browser treating the two as one origin.
func Nonce ¶
Nonce returns the application-script nonce issued for this response. It is empty only when the caller renders outside Protect, as isolated component tests do.
func Protect ¶
Protect stamps every final response with the refusal to be embedded by any origin but yomihon's own, the reading shell's content policy, and the referrer and sniffing headers. Every path that commits a response reasserts them first — a named status, a body written without one, a ReadFrom copy, a flush, and the implicit 200 after a handler writes nothing — and a new commit path has to do the same.
func SetContentSecurityPolicy ¶
SetContentSecurityPolicy replaces the reading shell's default policy for a response whose content owns a stricter sandbox, and reports whether that policy will reach the reader. A false answer means Protect will overwrite it at the commit boundary, so the bytes that needed it must not be written.
func WriteFailureLevel ¶ added in v0.2.0
WriteFailureLevel is how loudly a response that could not be written should be reported: debug when the reader left, error otherwise. It logs nothing itself. Either the request's context or the write's own broken-pipe or reset error can answer first, depending on how far the response had got.
Types ¶
This section is empty.
Source Files