Safe Haskell | Safe-Inferred |
---|---|
Language | Haskell2010 |
This module defines a generic web application interface. It is a common protocol between web servers and web applications.
The overriding design principles here are performance and generality. To
address performance, this library uses a streaming interface for request and
response bodies, paired with bytestring's Builder
type. The advantages of a
streaming API over lazy IO have been debated elsewhere and so will not be
addressed here. However, helper functions like responseLBS
allow you to
continue using lazy IO if you so desire.
Generality is achieved by removing many variables commonly found in similar
projects that are not universal to all servers. The goal is that the Request
object contains only data which is meaningful in all circumstances.
Please remember when using this package that, while your application may compile without a hitch against many different servers, there are other considerations to be taken when moving to a new backend. For example, if you transfer from a CGI application to a FastCGI one, you might suddenly find you have a memory leak. Conversely, a FastCGI application would be well served to preload all templates from disk when first starting; this would kill the performance of a CGI application.
This package purposely provides very little functionality. You can find various middlewares, backends and utilities on Hackage. Some of the most commonly used include:
Synopsis
- type Application = Request -> (Response -> IO ResponseReceived) -> IO ResponseReceived
- type Middleware = Application -> Application
- data ResponseReceived
- data Request
- defaultRequest :: Request
- data RequestBodyLength
- requestMethod :: Request -> Method
- httpVersion :: Request -> HttpVersion
- rawPathInfo :: Request -> ByteString
- rawQueryString :: Request -> ByteString
- requestHeaders :: Request -> RequestHeaders
- isSecure :: Request -> Bool
- remoteHost :: Request -> SockAddr
- pathInfo :: Request -> [Text]
- queryString :: Request -> Query
- getRequestBodyChunk :: Request -> IO ByteString
- requestBody :: Request -> IO ByteString
- vault :: Request -> Vault
- requestBodyLength :: Request -> RequestBodyLength
- requestHeaderHost :: Request -> Maybe ByteString
- requestHeaderRange :: Request -> Maybe ByteString
- requestHeaderReferer :: Request -> Maybe ByteString
- requestHeaderUserAgent :: Request -> Maybe ByteString
- strictRequestBody :: Request -> IO ByteString
- consumeRequestBodyStrict :: Request -> IO ByteString
- lazyRequestBody :: Request -> IO ByteString
- consumeRequestBodyLazy :: Request -> IO ByteString
- data Response
- type StreamingBody = (Builder -> IO ()) -> IO () -> IO ()
- data FilePart = FilePart {}
- responseFile :: Status -> ResponseHeaders -> FilePath -> Maybe FilePart -> Response
- responseBuilder :: Status -> ResponseHeaders -> Builder -> Response
- responseLBS :: Status -> ResponseHeaders -> ByteString -> Response
- responseStream :: Status -> ResponseHeaders -> StreamingBody -> Response
- responseRaw :: (IO ByteString -> (ByteString -> IO ()) -> IO ()) -> Response -> Response
- responseStatus :: Response -> Status
- responseHeaders :: Response -> ResponseHeaders
- responseToStream :: Response -> (Status, ResponseHeaders, (StreamingBody -> IO a) -> IO a)
- mapResponseHeaders :: (ResponseHeaders -> ResponseHeaders) -> Response -> Response
- mapResponseStatus :: (Status -> Status) -> Response -> Response
- ifRequest :: (Request -> Bool) -> Middleware -> Middleware
- modifyResponse :: (Response -> Response) -> Middleware
Types
type Application = Request -> (Response -> IO ResponseReceived) -> IO ResponseReceived Source #
The WAI application.
Note that, since WAI 3.0, this type is structured in continuation passing
style to allow for proper safe resource handling. This was handled in the
past via other means (e.g., ResourceT
). As a demonstration:
app :: Application app req respond = bracket_ (putStrLn "Allocating scarce resource") (putStrLn "Cleaning up") (respond $ responseLBS status200 [] "Hello World")
type Middleware = Application -> Application Source #
Middleware is a component that sits between the server and application. It can do such tasks as GZIP encoding or response caching. What follows is the general definition of middleware, though a middleware author should feel free to modify this.
As an example of an alternate type for middleware, suppose you write a function to load up session information. The session information is simply a string map \[(String, String)\]. A logical type signature for this middleware might be:
loadSession :: ([(String, String)] -> Application) -> Application
Here, instead of taking a standard Application
as its first argument, the
middleware takes a function which consumes the session information as well.
data ResponseReceived Source #
A special datatype to indicate that the WAI handler has received the response. This is to avoid the need for Rank2Types in the definition of Application.
It is highly advised that only WAI handlers import and use the data constructor for this data type.
Since 3.0.0
Request
Information on the request sent by the client. This abstracts away the details of the underlying implementation.
defaultRequest :: Request Source #
A default, blank request.
Since 2.0.0
data RequestBodyLength Source #
The size of the request body. In the case of chunked bodies, the size will not be known.
Since 1.4.0
Instances
Show RequestBodyLength Source # | |
Defined in Network.Wai.Internal showsPrec :: Int -> RequestBodyLength -> ShowS # show :: RequestBodyLength -> String # showList :: [RequestBodyLength] -> ShowS # |
Request accessors
requestMethod :: Request -> Method Source #
Request method such as GET.
httpVersion :: Request -> HttpVersion Source #
HTTP version such as 1.1.
rawPathInfo :: Request -> ByteString Source #
Extra path information sent by the client. The meaning varies slightly depending on backend; in a standalone server setting, this is most likely all information after the domain name. In a CGI application, this would be the information following the path to the CGI executable itself.
Middlewares and routing tools should not modify this raw value, as it may
be used for such things as creating redirect destinations by applications.
Instead, if you are writing a middleware or routing framework, modify the
pathInfo
instead. This is the approach taken by systems like Yesod
subsites.
Note: At the time of writing this documentation, there is at least one
system (Network.Wai.UrlMap
from wai-extra
) that does not follow the
above recommendation. Therefore, it is recommended that you test the
behavior of your application when using rawPathInfo
and any form of
library that might modify the Request
.
rawQueryString :: Request -> ByteString Source #
If no query string was specified, this should be empty. This value will include the leading question mark. Do not modify this raw value - modify queryString instead.
requestHeaders :: Request -> RequestHeaders Source #
A list of headers (a pair of key and value) in an HTTP request.
isSecure :: Request -> Bool Source #
Was this request made over an SSL connection?
Note that this value will not tell you if the client originally made
this request over SSL, but rather whether the current connection is SSL.
The distinction lies with reverse proxies. In many cases, the client will
connect to a load balancer over SSL, but connect to the WAI handler
without SSL. In such a case, isSecure
will be False
, but from a user
perspective, there is a secure connection.
remoteHost :: Request -> SockAddr Source #
The client's host information.
pathInfo :: Request -> [Text] Source #
Path info in individual pieces - the URL without a hostname/port and without a query string, split on forward slashes.
queryString :: Request -> Query Source #
Parsed query string information.
getRequestBodyChunk :: Request -> IO ByteString Source #
Get the next chunk of the body. Returns empty
when the
body is fully consumed.
Since: 3.2.2
requestBody :: Request -> IO ByteString Source #
Deprecated: requestBody's name is misleading because it only gets a partial chunk of the body. Use getRequestBodyChunk instead.
Get the next chunk of the body. Returns empty
when the
body is fully consumed. Since 3.2.2, this is deprecated in favor of getRequestBodyChunk
.
vault :: Request -> Vault Source #
A location for arbitrary data to be shared by applications and middleware.
requestBodyLength :: Request -> RequestBodyLength Source #
The size of the request body. In the case of a chunked request body, this may be unknown.
Since 1.4.0
requestHeaderHost :: Request -> Maybe ByteString Source #
The value of the Host header in a HTTP request.
Since 2.0.0
requestHeaderRange :: Request -> Maybe ByteString Source #
The value of the Range header in a HTTP request.
Since 2.0.0
requestHeaderReferer :: Request -> Maybe ByteString Source #
The value of the Referer header in a HTTP request.
Since 3.2.0
requestHeaderUserAgent :: Request -> Maybe ByteString Source #
The value of the User-Agent header in a HTTP request.
Since 3.2.0
Streaming Request Bodies
WAI is designed for streaming in request bodies, which allows you to process them incrementally.
You can stream in the request body using functions like getRequestBodyChunk
,
the wai-conduit
package, or Yesod's rawRequestBody
.
In the normal case, incremental processing is more efficient, since it reduces maximum total memory usage. In the worst case, it helps protect your server against denial-of-service (DOS) attacks, in which an attacker sends huge request bodies to your server.
Consider these tips to avoid reading the entire request body into memory:
- Look for library functions that support incremental processing. Sometimes these will use streaming
libraries like
conduit
,pipes
, orstreaming
. - Any attoparsec parser supports streaming input. For an example of this, see the
Data.Conduit.Attoparsec module in
conduit-extra
. - Consider streaming directly to a file on disk. For an example of this, see the
Data.Conduit.Binary module in
conduit-extra
. - If you need to direct the request body to multiple destinations, you can stream to both those
destinations at the same time.
For example, if you wanted to run an HMAC on the request body as well as parse it into JSON,
you could use Conduit's
zipSinks
to send the data tocryptonite-conduit
'ssinkHMAC
andaeson
's Attoparsec parser. - If possible, avoid processing large data on your server at all. For example, instead of uploading a file to your server and then to AWS S3, you can have the browser upload directly to S3.
That said, sometimes it is convenient, or even necessary to read the whole request body into memory.
For these purposes, functions like strictRequestBody
or lazyRequestBody
can be used.
When this is the case, consider these strategies to mitigating potential DOS attacks:
- Set a limit on the request body size you allow.
If certain endpoints need larger bodies, whitelist just those endpoints for the large size.
Be especially cautious about endpoints that don't require authentication, since these are easier to DOS.
You can accomplish this with
wai-extra
'srequestSizeLimitMiddleware
or Yesod'smaximumContentLength
. - Consider rate limiting not just on total requests, but also on total bytes sent in.
- Consider using services that allow you to identify and blacklist attackers.
- Minimize the amount of time the request body stays in memory.
- If you need to share request bodies across middleware and your application, you can do so using Wai's
vault
. If you do this, remove the request body from the vault as soon as possible.
Warning: Incremental processing will not always be sufficient to prevent a DOS attack.
For example, if an attacker sends you a JSON body with a 2MB long string inside,
even if you process the body incrementally, you'll still end up with a 2MB-sized Text
.
To mitigate this, employ some of the countermeasures listed above, and try to reject such payloads as early as possible in your codebase.
strictRequestBody :: Request -> IO ByteString Source #
Get the request body as a lazy ByteString. However, do not use any lazy I/O, instead reading the entire body into memory strictly.
Note: Since this function consumes the request body, future calls to it will return the empty string.
Since 3.0.1
consumeRequestBodyStrict :: Request -> IO ByteString Source #
Synonym for strictRequestBody
.
This function name is meant to signal the non-idempotent nature of strictRequestBody
.
Since: 3.2.3
lazyRequestBody :: Request -> IO ByteString Source #
Get the request body as a lazy ByteString. This uses lazy I/O under the surface, and therefore all typical warnings regarding lazy I/O apply.
Note: Since this function consumes the request body, future calls to it will return the empty string.
Since 1.4.1
consumeRequestBodyLazy :: Request -> IO ByteString Source #
Synonym for lazyRequestBody
.
This function name is meant to signal the non-idempotent nature of lazyRequestBody
.
Since: 3.2.3
Response
type StreamingBody = (Builder -> IO ()) -> IO () -> IO () Source #
Represents a streaming HTTP response body. It's a function of two parameters; the first parameter provides a means of sending another chunk of data, and the second parameter provides a means of flushing the data to the client.
Since 3.0.0
Information on which part to be sent.
Sophisticated application handles Range (and If-Range) then
create FilePart
.
Response composers
responseFile :: Status -> ResponseHeaders -> FilePath -> Maybe FilePart -> Response Source #
Creating Response
from a file.
responseBuilder :: Status -> ResponseHeaders -> Builder -> Response Source #
Creating Response
from Builder
.
Some questions and answers about the usage of Builder
here:
Q1. Shouldn't it be at the user's discretion to use Builders internally and then create a stream of ByteStrings?
A1. That would be less efficient, as we wouldn't get cheap concatenation with the response headers.
Q2. Isn't it really inefficient to convert from ByteString to Builder, and then right back to ByteString?
A2. No. If the ByteStrings are small, then they will be copied into a larger buffer, which should be a performance gain overall (less system calls). If they are already large, then an insert operation is used to avoid copying.
Q3. Doesn't this prevent us from creating comet-style servers, since data will be cached?
A3. You can force a Builder to output a ByteString before it is an optimal size by sending a flush command.
responseLBS :: Status -> ResponseHeaders -> ByteString -> Response Source #
Creating Response
from ByteString
. This is a wrapper for
responseBuilder
.
responseStream :: Status -> ResponseHeaders -> StreamingBody -> Response Source #
Creating Response
from a stream of values.
In order to allocate resources in an exception-safe manner, you can use the
bracket
pattern outside of the call to responseStream
. As a trivial
example:
app :: Application app req respond = bracket_ (putStrLn "Allocating scarce resource") (putStrLn "Cleaning up") $ respond $ responseStream status200 [] $ \write flush -> do write $ byteString "Hello\n" flush write $ byteString "World\n"
Note that in some cases you can use bracket
from inside responseStream
as well. However, placing the call on the outside allows your status value
and response headers to depend on the scarce resource.
Since 3.0.0
responseRaw :: (IO ByteString -> (ByteString -> IO ()) -> IO ()) -> Response -> Response Source #
Create a response for a raw application. This is useful for "upgrade" situations such as WebSockets, where an application requests for the server to grant it raw network access.
This function requires a backup response to be provided, for the case where the handler in question does not support such upgrading (e.g., CGI apps).
In the event that you read from the request body before returning a
responseRaw
, behavior is undefined.
Since 2.1.0
Response accessors
responseHeaders :: Response -> ResponseHeaders Source #
Accessing ResponseHeaders
in Response
.
Response modifiers
responseToStream :: Response -> (Status, ResponseHeaders, (StreamingBody -> IO a) -> IO a) Source #
Converting the body information in Response
to a StreamingBody
.
mapResponseHeaders :: (ResponseHeaders -> ResponseHeaders) -> Response -> Response Source #
Apply the provided function to the response header list of the Response.
mapResponseStatus :: (Status -> Status) -> Response -> Response Source #
Apply the provided function to the response status of the Response.
Middleware composition
ifRequest :: (Request -> Bool) -> Middleware -> Middleware Source #
conditionally apply a Middleware
modifyResponse :: (Response -> Response) -> Middleware Source #
apply a function that modifies a response as a Middleware