AcceptHeader

Summary

The AcceptHeader middleware checks a request’s Accept header against the Content-Type of the response your resource produced. It is added to resources using a resource group.

The highlighted section below shows how it is added:

// Code is shortened for brevity
 
import { ResourceGroup } from "@drashland/drash/modules/http.native.js";
import { AcceptHeader } from "@drashland/drash/modules/middleware/AcceptHeader.js";
 
const group = ResourceGroup
  .builder()
  .middleware(AcceptHeader()) // Calling it with no options uses the defaults
  .resources(Users)
  .build();

Like the other pre-built middleware, AcceptHeader is a factory. Calling it returns a middleware class with your options already bound to it.

Configuring Options

The Defaults

Options you leave out keep their defaults — the middleware merges what you pass over defaultOptions, so a partial object is safe.

Allowing Requests Without an Accept Header

If you want the content-type check but not the “you must ask” rule, turn the first one off:

// A request with no Accept header is allowed through. If it does send one, it
// is still checked against the response.
AcceptHeader({
  throw_if_accept_header_missing: false,
});

Allowing Mismatched Content Types

The reverse: keep requiring the header, but do not police what your resources answer with:

// The client must say what it accepts. What comes back is not checked against
// it.
AcceptHeader({
  throw_if_accept_header_mismatched: false,
});

Turning both off leaves the middleware sitting in the chain doing nothing. Remove it instead:

// Pointless. Neither check runs.
AcceptHeader({
  throw_if_accept_header_missing: false,
  throw_if_accept_header_mismatched: false,
});

How It Works

TLDR

The middleware reads the request’s Accept header on the way in, lets your resource produce a response, then compares that response’s Content-Type against what the client asked for. Either check can throw.

Detailed Explanation

Unlike CORS, this middleware never answers a request itself. It runs on the way in, calls your resource, and then inspects what came back — which is why the mismatch check can exist at all. The Content-Type does not exist until the resource has produced it.

*/* satisfies any content type. A specific Accept such as application/json is satisfied when the response’s Content-Type matches it.

Data Flow

As you can see above, the middleware is involved twice: once before the resource to check the header is there, and once after it to check the response satisfies it.

Extending This Middleware

The module exports the class as well as the factory, so you can extend it:

import { AcceptHeaderMiddleware } from "@drashland/drash/modules/middleware/AcceptHeader.js";
 
class LoggedAcceptHeader extends AcceptHeaderMiddleware {
  constructor() {
    // Your options go here, the same ones you would pass to AcceptHeader().
    super({ throw_if_accept_header_missing: false });
  }
 
  public override ALL(request: Request) {
    console.log(`Accept: ${request.headers.get("accept")}`);
 
    // Hand it back to the original middleware and get out of the way.
    return super.ALL(request);
  }
}