Milo

Appearance

std/httpmw ​

Optional middleware for std/http: JWT bearer authentication and gzip response compression. It lives outside std/http so a plain server never pulls in the crypto and compression modules. The functions take the Context rather than being methods on it, which is what keeps this file a pure add-on.

milo
from "std/httpmw" import { gzip, bearerToken, verifyBearer }

API reference ​

acceptsGzip ​

milo
pub fn acceptsGzip(headerVal: &string): bool

Substring test for "gzip" in an Accept-Encoding value. Deliberately loose: it does not parse q-values, so gzip;q=0 would still match — acceptable, since a client that lists gzip at all can decode it.

bearerToken ​

milo
pub fn bearerToken(ctx: &Context): string

Token from an Authorization: Bearer <token> header; "" if absent or wrong scheme. Scheme match is case-insensitive (RFC 7235 §2.1), the token is not.

gzip ​

milo
pub fn gzip(ctx: &mut Context, next: (&mut Context) => Response): Response

Middleware: gzip the response body when the client sent Accept-Encoding: gzip and the body clears GZIP_MIN. Sets Content-Encoding: gzip; Content-Length is recomputed from the (compressed) body downstream, so no manual length bookkeeping.

verifyBearer ​

milo
pub fn verifyBearer(ctx: &Context, secret: &string): Result<JwtClaims, JwtError>

The claims of the request's bearer token, if it carries one with a valid HS256 signature for secret that is in its validity window right now.

Returns the claims rather than a bool because "is this request authenticated" is not a question a handler can answer without them: the subject, the scopes, and the audience all live in the payload, and a bool tempts the caller to trust a token that expired years ago. JwtError.Expired and JwtError.BadSignature are different situations — the first is a refresh, the second is an attack — so the reason is preserved.

"No Authorization header" and "an Authorization header that is not a Bearer token" are also kept apart: the first is an unauthenticated request and the second is a misconfigured client, and the log line is the only place anyone ever finds that out.

For an audience or issuer requirement, or a non-HS256 algorithm, build a JwtVerifier and hand it bearerToken(ctx) yourself.