One request, read whole.
The body is eager and capped: HttpApp.maxBodySize decides how much of it is read, and exceeding the cap is a 413 rather than a stream nobody drains. What is deliberately absent is an untyped attachment: AnyRef bag. A capability arrives through the handler's using list, where its absence is a compile error rather than a sys.error on the first request that needs it.
The session is read for the handler out of the signed cookie once the route has matched, and only on a browser route: no session takes part in an API route, so a request there carries the empty one whatever cookie it sent, and so does a request built by hand until a test says otherwise with copy.
secure is whether the browser reached the application over HTTPS, which is what decides a cookie's Secure attribute. A request built by hand is not.
currentUser is who the guard says is behind this request, as the key the session spells it with, and it is a fact about the request rather than a way to ask one: http holds the value and whoever owns the rule, a guard, holds the rule. It is written before the handler it is for runs, by the guard's own wrapper on a guarded page and by the route table's identify on a socket upgrade, and never from a header, a query or path parameter, or a frame, all of which a client chooses. Nobody is None, which is what every request in an application with no way of signing in carries, and what a request built by hand carries until something names it.
Attributes
- Companion
- object
- Source
- Request.scala
- Graph
-
- Supertypes