Documentation
¶
Overview ¶
Package blobserve writes stored binary content to an HTTP response.
Every raw-content endpoint in the platform — portal assets, asset versions, thumbnails, public share content, managed resources — serves bytes that a user uploaded or an upstream API produced, under a content type that came from the same untrusted place. They all need the same four things, and getting any of them wrong on one endpoint is a bug on that endpoint alone, which is why this is one function rather than a convention:
- X-Content-Type-Options: nosniff, so a browser cannot decide for itself that a text/plain response is really HTML and run it.
- A Content-Type reduced to a parsed, parameter-free media type, so a stored value like `text/plain; charset=utf-8"><script>` cannot smuggle anything into the header.
- Content-Disposition: attachment for active types (HTML, JSX, SVG, JavaScript), which must never render inline on the platform's own origin, and inline for the passive families a viewer embeds.
- Byte-range support, so an audio or video element can seek without downloading the whole object first.
Index ¶
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
Types ¶
type Options ¶
type Options struct {
// Name is the object's display filename. It is used for the
// Content-Disposition filename and must not be empty for downloads.
Name string
// ContentType is the stored media type. It is sanitized before it reaches
// the response; an empty or unparseable value serves as
// application/octet-stream.
ContentType string
// ModTime is the object's last-modified time, used for If-Range and
// conditional-request handling. The zero value disables both.
ModTime time.Time
// Data is the object's full content.
Data []byte
// ForceAttachment serves the blob as a download regardless of family. Set
// it on endpoints that exist to download, not to preview.
ForceAttachment bool
}
Options describes one blob to serve.
Source Files
Click to show internal directories.
Click to hide internal directories.