mirror of
https://github.com/yhirose/cpp-httplib.git
synced 2026-10-19 11:19:36 +00:00
yhirose
9bfd2ddf1c
Bring the READMEs and the docs pages (en and ja) in line with the current header: - Fix the client sample that does not compile, the Transfer-Encoding statement for default headers, the verifier callback comment, the thread pool spawn rule, the sanitize_filename description, and the inverted Accept-Encoding sentence. - Describe recent behaviour: TLS errors behind Read/Write failures, Host validation, Connection: close for a body without length, content_reader rules, refused CONNECT, WebSocketClient proxies, CPPHTTPLIB_INTERIM_RESPONSE_MAX_COUNT, the SSE event size limit, and the payload limit of the Stream API. - Complete the API references of WebSocket, WebSocketClient and the stream:: helpers, and the SSE reconnect rules. - Fix cookbook pages: keychain loading on every backend, received Close status, a multipart sample that trusted the client's file name, an echo sample that sent binary as text, SNI, pre-request handler scope, stop() with WebSocket handlers, and the thread pool notes. - Restore the mutex in the LLM app's Chapter 5 code.
56 lines
2.9 KiB
Markdown
56 lines
2.9 KiB
Markdown
---
|
|
title: "S11. Authenticate Per Route with a Pre-Request Handler"
|
|
order: 30
|
|
status: "draft"
|
|
---
|
|
|
|
The `set_pre_routing_handler()` from [S09. Add pre-processing to all routes](../s09-pre-routing) runs **before routing**, so it has no idea which route matched. When you want per-route behavior, `set_pre_request_handler()` is what you need.
|
|
|
|
## Pre-routing vs. pre-request
|
|
|
|
| Hook | When it runs | Route info | Request body |
|
|
| --- | --- | --- | --- |
|
|
| `set_pre_routing_handler` | Before routing | Not available | Not read yet |
|
|
| `set_pre_request_handler` | After routing, right before the route handler | Available via `req.matched_route` | Not read yet |
|
|
|
|
In a pre-request handler, `req.matched_route` holds the **pattern string** that matched. You can vary behavior based on the route definition itself.
|
|
|
|
Because the body has not been read when the pre-request handler runs, you can reject a request — for example on a failed auth check — without consuming a (potentially large) request body. Note that this also means `req.body` and form fields parsed from the body are not available here; inspect headers, the path, query parameters, or `req.matched_route` instead.
|
|
|
|
The pre-request handler runs only for requests that match a route. Files served by `set_mount_point()` are answered before route matching, so guard static files in the pre-routing handler.
|
|
|
|
## Switch auth per route
|
|
|
|
```cpp
|
|
svr.set_pre_request_handler(
|
|
[](const httplib::Request &req, httplib::Response &res) {
|
|
// require auth for routes starting with /admin
|
|
if (req.matched_route.rfind("/admin", 0) == 0) {
|
|
auto token = req.get_header_value("Authorization");
|
|
if (!is_admin_token(token)) {
|
|
res.status = 403;
|
|
res.set_content("forbidden", "text/plain");
|
|
return httplib::Server::HandlerResponse::Handled;
|
|
}
|
|
}
|
|
return httplib::Server::HandlerResponse::Unhandled;
|
|
});
|
|
```
|
|
|
|
`matched_route` is the pattern **before** path parameters are expanded (e.g. `/admin/users/:id`). You compare against the route definition, not the actual request path, so IDs or names don't throw you off.
|
|
|
|
The pre-request handler also runs for routes registered with `svr.WebSocket()`. It is called before the `101 Switching Protocols` response, so returning `Handled` sends your HTTP response (such as a 403) and the connection is never upgraded.
|
|
|
|
The server accepts a handshake from any `Origin`. A browser sends its cookies even with a handshake that another site starts, so if cookies authenticate the connection, also check `req.get_header_value("Origin")` against your own origins here.
|
|
|
|
## Return values
|
|
|
|
Same as pre-routing — return `HandlerResponse`.
|
|
|
|
- `Unhandled`: continue (the route handler runs)
|
|
- `Handled`: we're done, skip the route handler
|
|
|
|
## Passing auth info to the route handler
|
|
|
|
To pass decoded user info into the route handler, use `res.user_data`. See [S12. Pass data between handlers with `res.user_data`](../s12-user-data).
|