HTTP configuration
[http]
Link layout, body decoding, CORS, compression, Server-Timing, security headers and CSRF.[http]
link_field = "combined"
How the Link values of a response or an HTTP notification are spread over field lines. All layouts mean the same; pick the one your clients read.
[http.body_decoding]
[http.body_decoding]
blocking_threshold = "256 KiB"
max_concurrent_blocking = 4
The body size from which a body is parsed on a separate thread pool instead of the request's own worker, so a large body does not stall unrelated requests sharing that worker.
How many large bodies are parsed on the separate thread pool at once. A parse holds memory in proportion to its body while it runs; a body waiting for its turn holds only its bytes.
[http.cors]
[http.cors]
mode = "permissive"
allow_origins = "any"
allow_methods = "any"
allow_headers = "any"
expose_headers = []
credentials = "refused"
private_network = "refused"
# preflight_lifetime = "10m"
Which CORS policy applies. Only "configured" reads the other keys of this table. "permissive" by default, so a browser-based interface works against the broker from any origin, and since it allows no credentials a page cannot act with a user's cookies; set "configured" to name the origins a deployment serves.
The origins allowed to read the API: "any", or a list such as ["https://dashboard.example.org"]. Read only when http.cors.mode is "configured".
The methods allowed: "any", "mirror" to allow whatever the preflight asks for, or a list such as ["GET", "POST"]. Read only when http.cors.mode is "configured".
The request headers allowed: "any", "mirror" to allow whatever the preflight asks for, or a list of header names. Read only when http.cors.mode is "configured".
The response headers a browser script may read: "any", or a list of header names. Read only when http.cors.mode is "configured".
Whether cookies and HTTP authentication may accompany a cross-origin request. Read only when http.cors.mode is "configured".
Whether a private-network preflight is answered with Access-Control-Allow-Private-Network. Read only when http.cors.mode is "configured".
How long a browser may cache a preflight answer, sent as Access-Control-Max-Age. Left out, the broker sends no Access-Control-Max-Age and the browser's own default applies. Read only when http.cors.mode is "configured".
[http.compression]
[http.compression]
mode = "enabled"
algorithms = ["gzip", "brotli", "deflate", "zstd"]
quality = "default"
Whether responses are compressed. Turn it off when a proxy in front compresses them.
The codings responses may be compressed with, chosen against the client's Accept-Encoding. Read only when http.compression.mode is "enabled".
How hard the compressor works.
[http.decompression]
[http.decompression]
mode = "enabled"
algorithms = ["gzip", "brotli", "deflate", "zstd"]
unaccepted_encoding = "refused"
Whether request bodies in a content coding are decoded. Off, every body is read as it arrives, and http.decompression.unaccepted_encoding does not apply.
The codings a request body may arrive in, decoded before the body is read. Read only when http.decompression.mode is "enabled".
What happens to a body in a coding that is not listed. Read only when http.decompression.mode is "enabled".
[http.forwarded]
Forwarded, X-Forwarded-Proto and X-Forwarded-Host fields decide the scheme and host of the URLs the broker builds. Believe them only from a reverse proxy that overwrites them.[http.forwarded]
trust = "none"
proxies = []
Whose forwarded fields the broker believes.
The IP addresses and subnets ("10.0.0.0/8", "192.0.2.7", "fd00::/8") of the proxies whose forwarded fields are believed, matched against the address a request arrives from. An IPv4 peer reaching a dual-stack listener is matched as its IPv4 address.
[http.server_timing]
Server-Timing header, and what it reports.[http.server_timing]
mode = "enabled"
phases = ["total"]
Whether responses carry a Server-Timing header.
Which times the header reports.
[http.security_headers]
[http.security_headers]
mode = "enabled"
cross_origin_opener_policy = "same-origin"
cross_origin_resource_policy = "same-origin"
origin_agent_cluster = "origin-keyed"
referrer_policy = "no-referrer"
x_content_type_options = "nosniff"
x_dns_prefetch_control = "off"
x_download_options = "noopen"
x_frame_options = "same-origin"
x_permitted_cross_domain_policies = "none"
x_xss_protection = "off"
Whether API responses carry the security headers below. Turn it off when a proxy in front sets them all; to drop one header, set its own key to "disabled".
The Cross-Origin-Opener-Policy header.
The Cross-Origin-Resource-Policy header.
The Origin-Agent-Cluster header.
The Referrer-Policy header.
The X-Content-Type-Options header.
The X-DNS-Prefetch-Control header.
The X-Download-Options header.
The X-Frame-Options header.
The X-Permitted-Cross-Domain-Policies header.
The X-XSS-Protection header.
[http.security_headers.content_security_policy]
Content-Security-Policy header.[http.security_headers.content_security_policy]
mode = "enabled"
policy = "default-src 'self'; base-uri 'self'; font-src 'self' https: data:; form-action 'self'; frame-ancestors 'self'; img-src 'self' data:; object-src 'none'; script-src 'self'; script-src-attr 'none'; style-src 'self' https: 'unsafe-inline'; upgrade-insecure-requests"
Whether API responses carry a Content-Security-Policy header.
The policy the header carries.
[http.security_headers.strict_transport_security]
Strict-Transport-Security header, sent only on a response to a request that arrived over the TLS listener.[http.security_headers.strict_transport_security]
mode = "disabled"
max_age = "180days"
include_subdomains = "disabled"
Whether a response to a request over the TLS listener carries Strict-Transport-Security. A browser that sees it uses HTTPS for the host until max_age passes. Off by default, since a browser that has seen it cannot reach the host over plain HTTP again until then; turn it on once HTTPS is the only way the host is reached.
How long a browser keeps using HTTPS for the host, the header's max-age. Zero tells a browser to forget the host.
Whether the policy also covers every subdomain of the host, the header's includeSubDomains.
[http.csrf]
[http.csrf]
mode = "disabled"
trusted_origins = []
Whether a cross-site request from an origin outside http.csrf.trusted_origins is answered 403. Same-origin requests, requests with neither Origin nor Sec-Fetch-Site, and GET, HEAD and OPTIONS always go through. Off by default, since the broker itself authenticates no one. Turn it on when a proxy in front authenticates browsers, by cookie or by HTTP authentication, because a forged cross-site request would then carry the user's credentials.
The browser origins whose cross-site requests are trusted, in addition to same-origin requests.