public final class StaticFiles

Serves files out of a document root, on the kernel’s zero-copy path.

The body goes out with sendfile() where the platform has it: the bytes move from the page cache to the socket inside the kernel, never entering this process. For a file server that is the difference between two copies per byte and none. TLS is the exception and always will be – encrypted bytes have to be produced in user space, so that path reads and writes like anything else.

Correctness this does NOT cut corners on:

• the resolved file must be inside the root, proven with realpath() rather than by inspecting the request string. “../” is only the obvious attack; percent-encoding and a symlink pointing out of the tree are the other two, and only resolution catches all three
• the descriptor is opened FIRST and stat’d from the open fd, so the length in the header and the bytes in the body describe the same file even if it is replaced mid-request
• conditional requests (If-None-Match, If-Modified-Since) and ranges, because a static server without them re-sends whole files to clients that already have them