The highest tagged major version is
Documentation
¶
Index ¶
Constants ¶
const DefaultAllowedDotPrefix = ".well-known"
DefaultAllowedDotPrefix is the one dot-prefixed path element a file server retrieves out of the box: RFC 8615 publishes an ACME http-01 challenge, security.txt and assetlinks.json under it, and a deployment that renews its certificate through the application would otherwise lose that renewal to the dot-prefix refusal.
Variables ¶
This section is empty.
Functions ¶
func EtagMatchesIfNoneMatch ¶ added in v1.19.0
the header is a comma-separated list and a proxy may weaken a strong tag, so an exact string comparison silently re-sends the whole body; the RFC weak comparison ignores the W/ prefix on either side. The wildcard form is deliberately not honoured — it would turn an attacker-supplied header into an unconditional 304 for no practical gain.
func GenerateEtag ¶
GenerateEtag derives the entity tag from the size and the modification time, and from the size and the BUILD VERSION for a filesystem that carries no modification time. An embedded filesystem is that filesystem: every FileInfo it hands out reports the zero instant, so the size-and-time form degenerated into size alone — identical across every rebuild — and a redeployed asset that kept its length (a version string, a colour, a bundle that re-minified to the same size) revalidated 304 and stayed served stale for the life of the deployment. The build version is the coarser but honest stand-in: every asset revalidates once after a deploy and no asset of the previous build survives it.
The modification time is read at NANOSECOND resolution. At the whole second the Unix form used, two rewrites within the same second that kept the same length produced an identical tag — a deploy that swapped a bundle for one of the same size revalidated 304 and stayed served stale until its length or its second changed. If-None-Match carries this tag and takes precedence over If-Modified-Since, so the finer tag catches the change the second-resolution Last-Modified cannot. A filesystem whose FileInfo reports only whole seconds keeps the whole-second tag; nothing is lost.
Types ¶
type FileServer ¶
type FileServer struct {
// contains filtered or unexported fields
}
func NewFileServer ¶
func NewFileServer(options *Options) *FileServer
func (*FileServer) Serve ¶
func (instance *FileServer) Serve( request httpcontract.Request, logger loggingcontract.Logger, ) (int, nethttp.Header, []byte, bool)
func (*FileServer) ServeReader ¶
func (instance *FileServer) ServeReader( request httpcontract.Request, logger loggingcontract.Logger, ) (int, nethttp.Header, io.ReadCloser, bool)
type FileServerConfig ¶
type FileServerConfig struct {
// contains filtered or unexported fields
}
func NewFileServerConfig ¶
func (*FileServerConfig) SetAllowedDotPrefixList ¶ added in v1.19.0
func (instance *FileServerConfig) SetAllowedDotPrefixList(allowedDotPrefixList []string)
SetAllowedDotPrefixList names the dot-prefixed first path elements the file server may retrieve. The default carries ".well-known" alone, which is where an ACME http-01 challenge, security.txt and assetlinks.json are published, and every other dot-prefixed element stays refused so a stray .env or .git never leaves the public directory. The allowance never reaches past the first element, so ".well-known/.env" is refused exactly like "/.env". An empty list refuses every dot-prefixed path. NewFileServer copies the configuration at construction, so this is set before the server is built; called later it configures the next server, not one already serving.
func (*FileServerConfig) SetExcludedPathList ¶ added in v1.19.0
func (instance *FileServerConfig) SetExcludedPathList(excludedPathList []string)
SetExcludedPathList names the path prefixes the file server declines without looking at the disk. A declined request continues down the rest of the chain, so an excluded prefix is how the part of the url it names is handed to the application: to a middleware that authenticates it, to a stricter policy, or to a file server of its own. An entry is a prefix of the request path exactly as security.NewPathPrefixMatcher reads one — the raw path, before the strip prefix is removed and before the path is folded — so a rule written for a firewall and a rule written here select the same requests. An empty entry therefore names every path and switches the file server off entirely. The default list is empty, which excludes nothing. NewFileServer copies the configuration at construction, so this is set before the server is built; called later it configures the next server, not one already serving.
type Options ¶
type Options struct {
// contains filtered or unexported fields
}
func NewOptions ¶
func NewOptions( fileServerConfig *FileServerConfig, root string, fileSystem fs.FS, ) *Options
Source Files