Middleware

type Middleware = Handler -> Handler
// Which expands to:
// (Request -> Task<Response>) -> (Request -> Task<Response>)

// Allow all origins
App.defaults |> App.middleware Cors.allowAll
 
// Configured
let cors =
    Cors.defaults
    |> Cors.origins ["https://myapp.com"; "https://staging.myapp.com"]
    |> Cors.methods ["GET"; "POST"; "PUT"; "DELETE"]
    |> Cors.headers ["Authorization"; "Content-Type"]
    |> Cors.maxAge 3600
    |> Cors.build
 
App.defaults |> App.middleware cors

let jwtConfig =
    Jwt.defaults "your-256-bit-secret"
    |> Jwt.issuer "my-app"
    |> Jwt.audience "my-api"
 
// Apply to protected routes
Route.start
|> Route.group "/api" (fun t ->
    t
    |> Route.middleware (Jwt.validate jwtConfig)
    |> Route.get "/profile" (fun (req: Request) -> task {
        let claims = Jwt.claims req
        match claims with
        | Some c -> return Response.json {| sub = c.["sub"] |}
        | None -> return Response.unauthorized
    })
)

Jwt.defaults "signing-key"
|> Jwt.encryptionKey "encryption-key"

// 100 requests per minute, keyed by IP address
let rateLimiter =
    RateLimit.fixedWindow 100 (TimeSpan.FromMinutes 1.0) RateLimit.byIp
 
App.defaults |> App.middleware rateLimiter

// Rate limit by API key header
let byApiKey (req: Request) =
    req.Header "X-Api-Key" |> Option.defaultValue "anonymous"
 
RateLimit.fixedWindow 1000 (TimeSpan.FromHours 1.0) byApiKey

Timeout.after (TimeSpan.FromSeconds 30.0)

// Auto-select: brotli > gzip > none (based on Accept-Encoding)
App.defaults |> App.middleware Compress.auto
 
// Or choose specifically
App.defaults |> App.middleware Compress.gzip
App.defaults |> App.middleware Compress.brotli

App.defaults |> App.middleware RequestId.middleware

App.defaults |> App.middleware CorrelationId.middleware

// Default secure headers
App.defaults |> App.middleware SecureHeaders.middleware

let headers =
    SecureHeaders.defaults
    |> SecureHeaders.contentSecurityPolicy "default-src 'self'; script-src 'self' https://cdn.example.com"
    |> SecureHeaders.frameOptions "SAMEORIGIN"
    |> SecureHeaders.referrerPolicy "no-referrer"
    |> SecureHeaders.noHsts  // disable HSTS (e.g. for dev)
    |> SecureHeaders.build
 
App.defaults |> App.middleware headers

App.defaults |> App.middleware Csrf.middleware

// Hidden form input
let formView (req: Request) =
    form [] [
        Csrf.hiddenInput req  // <input type="hidden" name="_csrf" value="...">
        input [ Attr.Type "text"; Name "email" ]
        button [] [ str "Submit" ]
    ]
 
// Meta tag for AJAX
let layoutView (req: Request) =
    head [] [
        Csrf.metaTag req  // <meta name="csrf-token" content="...">
    ]

App.defaults |> App.middleware Session.middleware

let handler (req: Request) = task {
    // Read
    let username = Session.get<string> "username" req
 
    // Write
    Session.set "username" "alice" req
 
    // Remove a key
    Session.remove "username" req
 
    // Clear entire session
    Session.clear req
 
    return Response.ok
}

let testStore = Session.SessionStore()
App.defaults |> App.middleware (Session.withStore testStore)

App.defaults
|> App.services [
    // In-memory IDistributedCache (single node) — both are in the shared framework:
    Service.raw (fun s -> s.AddDistributedMemoryCache() |> ignore)
]
|> App.middleware Session.distributed

// dotnet add package Microsoft.Extensions.Caching.StackExchangeRedis
App.defaults
|> App.services [
    Service.raw (fun s ->
        s.AddStackExchangeRedisCache(fun o -> o.Configuration <- "localhost:6379") |> ignore)
]
|> App.middleware Session.distributed

let store = Idempotent.inMemory ()
let ttl = TimeSpan.FromMinutes 60.0
 
App.defaults |> App.middleware (Idempotent.middleware store ttl)

type IdempotencyStore =
    abstract TryGet : key:string -> Task<CachedResponse option>
    abstract Set : key:string * response:CachedResponse * ttl:TimeSpan -> Task<unit>

let healthHandler =
    Health.handler [
        Health.ping  // always healthy
        Health.check "database" (fun () -> task {
            // Check DB connectivity
            do! db.PingAsync()
        })
        Health.check "redis" (fun () -> task {
            do! redis.PingAsync()
        })
    ]
 
Route.start
|> Route.get "/health" healthHandler

// Public cache with max-age
Route.middleware (Cache.maxAge 3600)
 
// Private (user-specific) cache
Route.middleware (Cache.privateMaxAge 60)
 
// Disable caching
Route.middleware Cache.noStore
 
// Vary by headers
Route.middleware (Cache.varyBy ["Accept"; "Accept-Encoding"])
 
// Auto ETag with 304 Not Modified
Route.middleware Cache.etag
 
// Combined: max-age + ETag + Vary
Route.middleware (Cache.standard 3600 ["Accept"])

App.defaults |> App.middleware Telemetry.middleware

App.defaults
|> App.services [ Telemetry.otlp "my-service" ]
|> App.middleware Telemetry.middleware

Telemetry.sourceName  // "Firefly"
Telemetry.meterName   // "Firefly"

App.defaults |> App.dashboard "/dashboard"

App.defaults
|> App.middleware myAdminGuard   // your own middleware that rejects non-admins
|> App.dashboard "/dashboard"

// 10 MB limit
Route.middleware (Upload.maxSize (10L * 1024L * 1024L))

let timing : Middleware =
    fun next req -> task {
        let sw = System.Diagnostics.Stopwatch.StartNew()
        let! response = next req
        sw.Stop()
        return response |> Response.header "X-Response-Time" $"{sw.ElapsedMilliseconds}ms"
    }

App.defaults |> App.middleware timing
// or
Route.middleware timing