Static Files & Security

🔒 Static Files & Security

Levtus is designed with a "Security First" mindset, providing built-in protection for serving static assets.

📂 Serving Static Files

By default, Levtus looks for a ./public directory. you can customize this using app.staticFiles().

Levtus app = Levtus.create();
app.staticFiles("./www"); // Serve from ./www

To serve a file within a route:

app.get("/", ctx -> {
    ctx.render("index.html");
});

🛡️ Security Features

Path Normalization

Levtus automatically normalizes paths provided to render(). It resolves . and .. segments and converts backslashes to forward slashes.

Directory Traversal Protection

The render() method checks if the resolved absolute path still resides within the configured static root. If a client attempts to use ../../etc/passwd to escape the root, Levtus will catch it and return a 403 Forbidden response.

MIME Type Probing

Levtus uses Java's Files.probeContentType() to automatically determine the correct Content-Type for the files it serves, falling back to application/octet-stream if unknown.

🛠 Security Hardening

You can further harden your server by limiting the surface area for attacks:

app.maxHeaderCount(50);      // Limit number of headers
app.maxHeaderSize(4096);     // Limit total header size
app.maxLineSize(2048);       // Limit request line length
app.maxBodySize(1024 * 1024); // Limit body to 1MB