Network.Wai.Middleware.Static

Serve static files, subject to a policy that can filter or modify incoming URIs. The flow is:

incoming request URI ==> policies ==> exists? ==> respond

If any of the polices fail, or the file doesn't exist, then the middleware gives up and calls the inner application. If the file is found, the middleware chooses a content type based on the file extension and returns the file contents as the response.

Middlewares

static :: Middleware

Serve static files out of the application root (current directory). If file is found, it is streamed to the client and no further middleware is run.

Note: for security reasons, this uses the noDots and isNotAbsolute policy by default.

staticPolicy :: Policy -> Middleware

Serve static files subject to a Policy

Note: for security reasons, this uses the noDots and isNotAbsolute policy by default.

unsafeStaticPolicy :: Policy -> Middleware

Serve static files subject to a Policy. Unlike static and staticPolicy, this has no policies enabled by default, and is hence insecure.

Policies

data Policy

Take an incoming URI and optionally modify or filter it. The result will be treated as a filepath.

Instances

Monoid Policy

Note: mempty == policy Just (the always accepting policy) mappend == >-> (policy sequencing)

(<|>) :: Policy -> Policy -> Policy

Choose between two policies. If the first fails, run the second.

(>->) :: Policy -> Policy -> Policy

Sequence two policies. They are run from left to right. (Note: this is mappend)

policy :: (String -> Maybe String) -> Policy

Lift a function into a Policy

predicate :: (String -> Bool) -> Policy

Lift a predicate into a Policy

addBase :: String -> Policy

Add a base path to the URI

 staticPolicy (addBase "/home/user/files")

GET "foo/bar" looks for "/home/user/files/foo/bar"

addSlash :: Policy

Add an initial slash to to the URI, if not already present.

 staticPolicy addSlash

GET "foo/bar" looks for "/foo/bar"

contains :: String -> Policy

Accept only URIs containing given string

hasPrefix :: String -> Policy

Accept only URIs with given prefix

hasSuffix :: String -> Policy

Accept only URIs with given suffix

noDots :: Policy

Reject URIs containing ".."

isNotAbsolute :: Policy

Reject URIs that are absolute paths

only :: [(String, String)] -> Policy

Use URI as the key to an association list, rejecting those not found. The policy result is the matching value.

 staticPolicy (only [("foo/bar", "/home/user/files/bar")])

GET "foo/bar" looks for "/home/user/files/bar" GET "baz/bar" doesn't match anything

Utilities

tryPolicy :: Policy -> String -> Maybe String

Run a policy