@askrjs/server/middleware

accessLogtype

accessLog: (logger: ResponseLogger) => Middleware

Creates middleware that times each request and invokes `logger` with the request, response, duration, and (if present) request ID after the downstream chain resolves.

corstype

cors: (options?: CorsOptions) => Middleware

Creates CORS middleware that validates the request origin, answers preflight `OPTIONS` requests with `204` and the appropriate `Access-Control-*` headers, and adds `Access-Control-Allow-Origin`/`Vary: Origin` (plus exposed headers) to actual responses. Genuine preflight is quota-neutral in {@link rateLimit } regardless of middleware order.

CorsOptionstype

CorsOptions: any

Options for {@link cors}.

origin

origin?: string | ((origin: string, context: ServerContext) => string | null);

methods

methods?: readonly string[];

allowedHeaders

allowedHeaders?: readonly string[];

exposedHeaders

exposedHeaders?: readonly string[];

credentials

credentials?: boolean;

maxAgeSeconds

maxAgeSeconds?: number;

createCsrfTokentype

createCsrfToken: (secret: string, sessionId: string) => Promise<string>

Creates a CSRF token bound to a session ID, as an HMAC-SHA256 signature encoded base64url.

createMemoryRateLimitStoretype

createMemoryRateLimitStore: (options?: MemoryRateLimitStoreOptions) => RateLimitStore

Creates an in-memory {@link RateLimitStore} backed by a `Map`, suitable for single-process deployments. Expired keys are pruned before capacity eviction, then the least recently used key is evicted when `maxEntries` is reached. Eviction forgets that key's current quota; use a custom store when the key space is adversarial or cannot be safely bounded for one process.

csrftype

csrf: (options: CsrfOptions) => Middleware

Creates middleware that enforces CSRF protection on state-changing requests (all methods except `GET`/`HEAD`/`OPTIONS`/`TRACE`) by requiring a valid token bound to the current session, supplied via a request header or (for form-encoded bodies) a form field.

CsrfOptionstype

CsrfOptions: any

Options for {@link csrf}.

secret

readonly secret: string;

sessionId

readonly sessionId?: (context: Parameters<Middleware>[0]) => string | undefined;

header

readonly header?: string;

formField

readonly formField?: string;

enforceHttpstype

enforceHttps: (options?: { trustProxy?: boolean; status?: 301 | 302 | 307 | 308; }) => Middleware

Creates middleware that redirects non-HTTPS requests to their HTTPS equivalent.

MemoryRateLimitStoreOptionstype

MemoryRateLimitStoreOptions: any

Options for {@link createMemoryRateLimitStore}.

now

readonly now?: () => number;

maxEntries

Maximum active keys retained in memory. Defaults to 10,000.

rateLimittype

rateLimit: (options: RateLimitOptions) => Middleware

Creates middleware that enforces a request-rate limit per key (e.g. per client), adding `RateLimit-*` response headers and returning `429 Too Many Requests` with `Retry-After` when the limit is exceeded. Genuine CORS preflight requests (`OPTIONS` with both `Origin` and `Access-Control-Request-Method`) are quota-neutral regardless of middleware order.

RateLimitOptionstype

RateLimitOptions: any

Options for {@link rateLimit}.

store

readonly store?: RateLimitStore;

limit

readonly limit: number;

windowMs

readonly windowMs: number;

key

Returns an application-trusted bucket identity. Proxy headers are intentionally never interpreted by this middleware.

now

readonly now?: () => number;

RateLimitStoretype

RateLimitStore: any

Pluggable backing store for {@link rateLimit}, tracking request counts per key/window.

consume

consume(key: string, limit: number, windowMs: number): Promise<{ readonly remaining: number; /** Epoch milliseconds at which the current window resets. */ readonly reset: number; readonly allowed: boolean; }>;

requestIdtype

requestId: (options?: { header?: string; generate?: () => string; }) => Middleware

Creates middleware that reads a request ID from an incoming header (generating one if absent), stores it on `ctx.state.requestId`, and echoes it back on the response header.

ResponseLoggertype

ResponseLogger: (entry: {
  request: Request;
  response: Response;
  durationMs: number;
  requestId?: string;
}) => void

Callback invoked by {@link accessLog} with details of a completed request.

securityHeaderstype

securityHeaders: (options?: { contentSecurityPolicy?: string | ((context: ServerContext) => string); referrerPolicy?: string; frameOptions?: string; }) => Middleware

Creates middleware that adds standard security headers to every response: `X-Content-Type-Options: nosniff`, `Referrer-Policy`, `X-Frame-Options`, and (if configured) `Content-Security-Policy`.

tracetype

trace: (start: (context: ServerContext) => void | (() => void | Promise<void>)) => Middleware

Creates middleware that invokes `start` at the beginning of each request and, if it returns a function, invokes that function after the downstream chain settles (success or throw) — e.g. to open and close a tracing span around the request.

verifyCsrfTokentype

verifyCsrfToken: (secret: string, sessionId: string, token: string) => Promise<boolean>

Verifies a CSRF token against a session ID using an HMAC-SHA256 signature.