repository·master·Indexed 43 days ago
https://github.com/ring-clojure/ring-defaultsProvides secure default middleware configurations for Ring applications, including site-defaults, api-defaults, and their secure SSL-forcing counterparts. It automates the ordering and selection of middleware for sessions, parameters, static assets, and security headers.
If your application is running behind a reverse proxy or a load balancer (common in cloud deployments), set :proxy to true in your configuration map. This is critical when using SSL/HTTPS, as it prevents the SSL redirect middleware from entering a redirect loop by allowing it to correctly identify the request scheme.
(assoc secure-site-defaults :proxy true)The default configurations (api-defaults, site-defaults, etc.) are standard Clojure maps. You can customize them using assoc to enable or disable specific features, such as removing session support from site-defaults.
(wrap-defaults handler (assoc site-defaults :session false))Add ring-defaults to your project dependencies to automate the setup of Ring middleware for websites or HTTP APIs.
;; For deps.edn
ring/ring-defaults {:mvn/version "0.7.1"}
;; For Leiningen
[ring/ring-defaults "0.7.1"]The wrap-defaults middleware applies a set of standard Ring middleware based on a configuration map. Use one of the four provided default configurations depending on your application type:
api-defaults: Adds support for urlencoded parameters.site-defaults: Adds support for parameters, cookies, sessions, static resources, file uploads, and browser-specific security headers.secure-api-defaults: Like api-defaults, but forces SSL (redirects HTTP to HTTPS).secure-site-defaults: Like site-defaults, but forces SSL.Note: The "secure" defaults redirect unencrypted HTTP URLs to HTTPS and include headers to prevent sensitive information from being sent over insecure channels.
(require '[ring.middleware.defaults :refer :all])
(def site
(wrap-defaults handler site-defaults))The following keys can be used to customize the middleware behavior within the configuration map passed to wrap-defaults.
;; Supported configuration keys:
:cookies ;; Boolean. Set to true to parse cookies from the request.
:params ;; Map of options for parsing parameters:
:keywordize ;; Boolean. Turn parameter keys into keywords.
:multipart ;; Boolean or Map. Parse urlencoded parameters or pass options to multipart-params.
:nested ;; Boolean. Allow nested parameters via nested-params.
:urlencoded ;; Boolean. Parse urlencoded parameters in query string and body.
:proxy ;; Boolean. Set to true if running behind a reverse proxy/load balancer.
:responses ;; Map of options to augment responses:
:absolute-redirects ;; Turn relative redirects into absolute URLs.
:content-length ;; Adds content-length middleware.
:content-types ;; Adds content-type middleware.
:default-charset ;; Adds a default charset to text content-types.
:not-modified-responses ;; Adds not-modified middleware.
:security ;; Options for security headers/behaviors:
:anti-forgery ;; Boolean or Map. Adds CSRF protection via ring-anti-forgery.
:content-type-options ;; Prevents media-type confusion attacks.
:frame-options ;; Prevents site from being placed in iframes.
:hsts ;; Boolean. Enable HTTP Strict Transport Security.
:ssl-redirect ;; Boolean or Map. Redirect HTTP to HTTPS. Map can include :ssl-port.
:xss-protection ;; [DEPRECATED] Enable X-XSS-Protection header.
:session ;; Map of options for session handling:
:flash ;; Boolean. Adds ring.middleware.flash.
:store ;; The Ring session store to use.
:static ;; Map of options for static content:
:files ;; String or Map. Options for file middleware (uses :root).
:resources ;; String or Map. Options for resource middleware (uses :root).
:websocket ;; Map of options for websocket behavior:
:keepalive ;; Boolean or Map. Adds websocket keepalive middleware. Map can include :period.