Every other page in this section teaches one piece of the HTTP layer by example. This page is
the other kind of reference: every function signature rel recognizes, and every
http.*/route.*/jwt.*/SSO configuration key, in one place, each linked to the page that
explains it. Skim this first to see the whole surface at a glance, or come back to it once you
know roughly what you're looking for and just need the exact name or default.
Runs ahead of every route//rel/static file under its own path prefix. See HTTP routes ## Middleware.
A function may also declare extra text-typed arguments, named after {placeholder}
segments in its own declared path — see HTTP routes ## Function
prototype.
Single-return mimetype table — applies to a plain return type, or a full-control
function's second OUT column when its own response doesn't override content_type:
Return type
Content-Type
text
text/plain
json/jsonb
application/json
bytea
application/octet-stream
a domain whose name contains / (over bytea or text)
the domain's own name, e.g. "image/png"
Invoked directly by rel, never discovered as routes¶
http.functions.sso_callback, or per-provider openid.<name>.callback_function/saml.<name>.callback_function
Turns a verified OIDC/SAML identity assertion into a role, the same way a login route mints a session. payload is {jwt, identity, state}. See Authentication ## OpenID Connect and SAML.
Every http.*/route.*/jwt.* key, plus the handful of pg.*/openid.*/saml.* keys that
are really part of the same HTTP-facing picture. Configuration reference
is the authoritative source for every key rel understands, HTTP or not — this table is the
HTTP-scoped subset, each row pointing at the page that explains the behavior, not just the key.
This deployment's externally-reachable host (bare, no scheme) — required for OIDC/SAML redirect URLs. See Authentication.
http.cookies_max_age
86400 (seconds)
Default max-age for a cookie set via the generic cookies field. Never applies to the JWT cookie. See Requests and responses.
http.max_body_size
10 MiB
Hard cap on a declared route request's entire body. See File uploads.
http.max_part_count
100
Max multipart/form-data parts per request. See File uploads.
http.static.path
/static
Colon-separated filesystem directories served at the router root, as the fallback for any path no declared route claims. See Static files.
http.upload.dir
unset (uploads disabled)
Subpath of the static write directory (the first entry of http.static.path) every stream_upload writes under — servable, but never jet-eligible. See File uploads.
http.upload.max_size
= http.max_body_size
Hard cap on a stream_upload route's streamed payload — independent of http.max_body_size since this path streams to disk, not memory. See File uploads.
A route is declared either way — a route::/route:{...} comment on the function, or the
config keys above; config overrides a comment declaration on the same function, with a
warning. See HTTP routes ## Declaring a route.