Router

HTTP route registration + dispatch. Operators register handlers against method+pattern pairs, the router compiles each pattern once at registration time and walks the table linearly per request — first match wins.

Patterns are segment-based (/users/:id); named parameters land on req.params. Handler dispatch follows arity: - handler.length >= 3 is middleware (req, res, next) — the chain stops unless next() is called. - handler.length <= 2 is a terminal handler (req, res) — the chain falls through to the next entry unless the response is already ended.

When no pattern matches, the registered onNotFound handler runs; the framework default is a 404 with a small text/html body. The router boots an HTTP/2 + HTTP/1.1 ALPN server on listen() when given TLS options, an HTTP/1.1 server otherwise.

Zero npm runtime deps — this primitive replaces express / koa / fastify entirely while keeping the framework's security defaults (TLS 1.3 minimum, 0-RTT anti-replay, Slowloris timeouts, h2 CONTINUATION-flood + Rapid-Reset caps) wired in by default.

b.router.serveStatic(dir) #

Returns a middleware function that serves files from dir for GET requests whose req.pathname resolves inside dir. Path traversal (..) and NUL-byte filenames bypass the middleware (next()), as do directory listings and missing files. Sniffed Content-Type comes from a small extension table; unknown extensions fall back to application/octet-stream. Versioned URLs (?v=...) ship with a one-year immutable Cache-Control; un-versioned files get one hour.

For richer content-safety, byte-range requests, and the framework's full guard wiring, prefer b.staticServe.create over this helper.

var router = b.router.create();
router.use(b.router.serveStatic("/var/www/public"));
router.listen(3000);

b.router.create(opts?) #

{
  tls0Rtt:                "refuse" | "replay-cache",  // RFC 8446 §8 anti-replay; default "refuse"
  allowedRedirectOrigins: string[],                    // exact-match HTTPS origins for cross-origin res.redirect()
}

Builds a Router instance with the framework's security-on-by- default posture. Returned object exposes get / post / put / patch / delete for route registration, use(...) for middleware, ws(path, handler, opts?) for WebSocket routes, onNotFound(fn) and onError(fn) for fallthrough hooks, inspectRoutes() and openapi() for introspection, closeWebSockets({ timeoutMs }) for graceful shutdown, and listen(port, cb?, tlsOptions?, host?) which boots an HTTP/2-capable TLS server (ALPN h2 + http/1.1) when tlsOptions is provided, an HTTP/1.1 server otherwise.

use has two forms. use(mw) (and use(mw1, mw2, ...)) mounts global middleware that runs on every request. use(prefix, mw1, mw2, ...) mounts path-scoped middleware that runs only when the request path is at or beneath prefix, matched on segment boundaries — "/admin" covers "/admin" and "/admin/x" but not "/administrator". The prefix may be an array of strings to scope a gate to several path roots at once. Global and scoped middleware interleave in registration order, so a gate registered before a route still runs before it. A non-string / non-array prefix, a prefix not beginning with "/", or a non-function middleware throws at registration time rather than dropping the gate or 500-ing every request — scope a security middleware (csrf, bearerAuth, requireAal, requireMtls) to a path with confidence it runs exactly where mounted.

var router = b.router.create({
  tls0Rtt: "refuse",
  allowedRedirectOrigins: ["https://idp.example.com"],
});
router.get("/users/:id", function (req, res) {
  res.json({ id: req.params.id });
});

// Global middleware — runs on every request.
router.use(b.middleware.securityHeaders());

// Path-scoped middleware — the step-up gate runs only under /admin.
router.use("/admin", b.middleware.requireAal({ minimum: "AAL2" }));

router.listen(3000);

Last updated 2026-08-08T16:39:49.652Z by seeder.