Class StaticFiles

java.lang.Object
com.codename1.backend.StaticFiles
All Implemented Interfaces:
HttpServer.Handler

public final class StaticFiles extends Object implements HttpServer.Handler

Serves files out of a document root, on the kernel's zero-copy path.

The body goes out with sendfile() where the platform has it: the bytes move from the page cache to the socket inside the kernel, never entering this process. For a file server that is the difference between two copies per byte and none. TLS is the exception and always will be -- encrypted bytes have to be produced in user space, so that path reads and writes like anything else.

Correctness this does NOT cut corners on:

  • the resolved file must be inside the root, proven with realpath() rather than by inspecting the request string. "../" is only the obvious attack; percent-encoding and a symlink pointing out of the tree are the other two, and only resolution catches all three
  • the descriptor is opened FIRST and stat'd from the open fd, so the length in the header and the bytes in the body describe the same file even if it is replaced mid-request
  • conditional requests (If-None-Match, If-Modified-Since) and ranges, because a static server without them re-sends whole files to clients that already have them
  • Constructor Details

    • StaticFiles

      public StaticFiles(String root, String prefix, String indexFile, String cacheControl) throws IOException
      • root: the document root; resolved once, and every request must land inside it
      • prefix: URL prefix to strip, "" or "/" for none
      • cacheControl: the Cache-Control value, or null to omit it
      Throws:
      IOException
  • Method Details