Skip to content

Documented js_access directive and r.readRequest* methods in njs. #272

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
xeioex merged 2 commits into from
May 7, 2026
Merged

Documented js_access directive and r.readRequest* methods in njs. #272

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
4f2804e
Documented js_access directive and r.readRequest* methods in njs
xeioex May 6, 2026
5ee396a
Removed obsolete bare-function syntax from rus module directives in njs
xeioex May 6, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
64 changes: 63 additions & 1 deletion xml/en/docs/http/ngx_http_js_module.xml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -9,7 +9,7 @@
<module name="Module ngx_http_js_module"
link="/en/docs/http/ngx_http_js_module.html"
lang="en"
rev="58">
rev="59">

<section id="summary">

Expand Down Expand Up @@ -267,6 +267,68 @@ since <link doc="../njs/changes.xml" id="njs0.7.7">0.7.7</link>.
</directive>


<directive name="js_access">
<syntax><value>module.function</value></syntax>
<default/>
<context>location</context>
<context>if in location</context>
<context>limit_except</context>
<appeared-in>0.9.9</appeared-in>

<para>
Sets an njs function as a handler in the
<link doc="../dev/development_guide.xml" id="http_phases">access phase</link>.
Asynchronous operations such as
<link doc="../njs/reference.xml" id="r_subrequest">r.subrequest()</link>,
<link doc="../njs/reference.xml" id="ngx_fetch">ngx.fetch()</link>,
and <link doc="../njs/reference.xml" id="settimeout">setTimeout()</link>
are supported.
</para>

<para>
A handler that returns without calling
<link doc="../njs/reference.xml" id="r_return"><literal>r.return()</literal></link>
or
<link doc="../njs/reference.xml" id="r_decline"><literal>r.decline()</literal></link>
grants access.
To deny access or send a custom response (for example, a redirect),
the handler may call
<link doc="../njs/reference.xml" id="r_return"><literal>r.return()</literal></link>.
To make the handler express no opinion, deferring the decision to other
access checkers under
<link doc="ngx_http_core_module.xml" id="satisfy"><literal>satisfy any</literal></link>,
the handler may call
<link doc="../njs/reference.xml" id="r_decline"><literal>r.decline()</literal></link>.
</para>

<para>
For example:
<example>
example.conf:
location /protected/ {
js_access main.auth;
proxy_pass http://upstream;
}

example.js:
async function auth(r) {
let reply = await ngx.fetch('http://authsvc/check', {
headers: {Authorization: r.headersIn.Authorization}
});

if (reply.status != 200) {
r.return(401);
return;
}
}

export default {auth};
</example>
</para>

</directive>


<directive name="js_content">
<syntax><value>module.function</value></syntax>
<default/>
Expand Down
10 changes: 9 additions & 1 deletion xml/en/docs/njs/compatibility.xml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -9,7 +9,7 @@
<article name="Compatibility"
link="/en/docs/njs/compatibility.html"
lang="en"
rev="47"
rev="48"
toc="no">

<section>
Expand Down Expand Up @@ -1178,6 +1178,14 @@ nginx object properties:
<link doc="reference.xml" id="r_internal"><literal>r.internal</literal></link>,
<link doc="reference.xml" id="r_method"><literal>r.method</literal></link>,
<link doc="reference.xml" id="r_parent"><literal>r.parent</literal></link>,
<link doc="reference.xml" id="r_read_request_array_buffer"><literal>r.readRequestArrayBuffer</literal></link>
(<link doc="changes.xml" id="njs0.9.9">0.9.9</link>),
<link doc="reference.xml" id="r_read_request_form"><literal>r.readRequestForm</literal></link>
(<link doc="changes.xml" id="njs0.9.9">0.9.9</link>),
<link doc="reference.xml" id="r_read_request_json"><literal>r.readRequestJSON</literal></link>
(<link doc="changes.xml" id="njs0.9.9">0.9.9</link>),
<link doc="reference.xml" id="r_read_request_text"><literal>r.readRequestText</literal></link>
(<link doc="changes.xml" id="njs0.9.9">0.9.9</link>),
<link doc="reference.xml" id="r_raw_headers_in"><literal>r.rawHeadersIn</literal></link>
(<link doc="changes.xml" id="njs0.4.1">0.4.1</link>),
<link doc="reference.xml" id="r_raw_headers_out"><literal>r.rawHeadersOut</literal></link>
Expand Down
168 changes: 167 additions & 1 deletion xml/en/docs/njs/reference.xml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -9,7 +9,7 @@
<article name="Reference"
link="/en/docs/njs/reference.html"
lang="en"
rev="134">
rev="135">

<section id="summary">

Expand Down Expand Up @@ -40,6 +40,7 @@ List of all njs properties and methods can be found in
<para>
<table width="100%">
<tr><td><link id="r_args"><literal>r.args{}</literal></link></td></tr>
<tr><td><link id="r_decline"><literal>r.decline()</literal></link></td></tr>
<tr><td><link id="r_done"><literal>r.done()</literal></link></td></tr>
<tr><td><link id="r_error"><literal>r.error()</literal></link></td></tr>
<tr><td><link id="r_finish"><literal>r.finish()</literal></link></td></tr>
Expand All @@ -51,6 +52,10 @@ List of all njs properties and methods can be found in
<tr><td><link id="r_log"><literal>r.log()</literal></link></td></tr>
<tr><td><link id="r_method"><literal>r.method</literal></link></td></tr>
<tr><td><link id="r_parent"><literal>r.parent</literal></link></td></tr>
<tr><td><link id="r_read_request_array_buffer"><literal>r.readRequestArrayBuffer()</literal></link></td></tr>
<tr><td><link id="r_read_request_form"><literal>r.readRequestForm()</literal></link></td></tr>
<tr><td><link id="r_read_request_json"><literal>r.readRequestJSON()</literal></link></td></tr>
<tr><td><link id="r_read_request_text"><literal>r.readRequestText()</literal></link></td></tr>
<tr><td><link id="r_remote_address"><literal>r.remoteAddress</literal></link></td></tr>
<tr><td><link id="r_request_body"><literal>r.requestBody</literal></link></td></tr>
<tr><td><link id="r_request_buffer"><literal>r.requestBuffer</literal></link></td></tr>
Expand Down Expand Up @@ -135,6 +140,23 @@ method can be used.
</para>
</tag-desc>

<tag-name id="r_decline"><literal>r.decline()</literal></tag-name>
<tag-desc>
makes the
<link doc="../http/ngx_http_js_module.xml" id="js_access"/> handler
express no opinion about access, deferring the decision to other access
checkers under
<link doc="../http/ngx_http_core_module.xml" id="satisfy"><literal>satisfy any</literal></link>
(<link doc="changes.xml" id="njs0.9.9">0.9.9</link>).
A handler that returns without calling
<link id="r_decline"><literal>r.decline()</literal></link>
or
<link id="r_return"><literal>r.return()</literal></link>
implicitly grants access.
May be called only from the
<link doc="../http/ngx_http_js_module.xml" id="js_access"/> function.
</tag-desc>

<tag-name id="r_done"><literal>r.done()</literal></tag-name>
<tag-desc>
after calling this function,
Expand Down Expand Up @@ -374,6 +396,137 @@ references the parent request object
client address, read-only
</tag-desc>

<tag-name id="r_read_request_array_buffer"><literal>r.readRequestArrayBuffer()</literal></tag-name>
<tag-desc>
returns a <literal>Promise</literal> that resolves with the client
request body as an <literal>ArrayBuffer</literal>
(<link doc="changes.xml" id="njs0.9.9">0.9.9</link>).
See
<link id="r_read_request_text"><literal>r.readRequestText()</literal></link>
for availability, body caching, and concurrency semantics.
</tag-desc>

<tag-name id="r_read_request_form"><literal>r.readRequestForm(<value>[options]</value>)</literal></tag-name>
<tag-desc>
reads the client request body and parses it as an HTML form,
returning a <literal>Promise</literal> that resolves with a form object
(<link doc="changes.xml" id="njs0.9.9">0.9.9</link>).
Supported content types are
<literal>application/x-www-form-urlencoded</literal>
and <literal>multipart/form-data</literal>.

<para>
The form object provides the following methods:
<list type="tag">

<tag-name><literal>get(<value>name</value>)</literal></tag-name>
<tag-desc>
returns the first value for <value>name</value>,
or <literal>null</literal> if absent.
</tag-desc>

<tag-name><literal>getAll(<value>name</value>)</literal></tag-name>
<tag-desc>
returns an array with all values for <value>name</value>.
</tag-desc>

<tag-name><literal>has(<value>name</value>)</literal></tag-name>
<tag-desc>
returns <literal>true</literal> if at least one entry exists
for <value>name</value>.
</tag-desc>

<tag-name><literal>forEach(<value>callback</value>[,
<value>thisArg</value>])</literal></tag-name>
<tag-desc>
invokes <value>callback</value> for each entry with arguments
<literal>(value, key, form)</literal>.
</tag-desc>

<tag-name><literal>hasFiles()</literal></tag-name>
<tag-desc>
returns <literal>true</literal> if the form contains any file parts.
</tag-desc>

</list>
</para>

<para>
For text fields, values are decoded strings.
For file parts, the value is an object with the client-supplied
filename available as the <literal>name</literal> property;
file contents are not exposed.
The filename is client-supplied and is not sanitized.
</para>

<para>
The optional <value>options</value> object accepts the following
properties:
<list type="tag">

<tag-name><literal>maxKeys</literal>
<value>number</value></tag-name>
<tag-desc>
the maximum number of fields to parse,
by default is <literal>128</literal>.
Exceeding the limit rejects the returned promise.
</tag-desc>

</list>
</para>

<para>
See
<link id="r_read_request_text"><literal>r.readRequestText()</literal></link>
for availability, body caching, and concurrency semantics.
The parsed form is itself cached on the request:
a subsequent call returns the same form object and ignores any
new <value>options</value> argument.
</para>
</tag-desc>

<tag-name id="r_read_request_json"><literal>r.readRequestJSON()</literal></tag-name>
<tag-desc>
returns a <literal>Promise</literal> that resolves with the client
request body parsed as JSON
(<link doc="changes.xml" id="njs0.9.9">0.9.9</link>).
See
<link id="r_read_request_text"><literal>r.readRequestText()</literal></link>
for availability, body caching, and concurrency semantics.
</tag-desc>

<tag-name id="r_read_request_text"><literal>r.readRequestText()</literal></tag-name>
<tag-desc>
returns a <literal>Promise</literal> that resolves with the client
request body as a string
(<link doc="changes.xml" id="njs0.9.9">0.9.9</link>).
The size of the request body is limited by
<link doc="../http/ngx_http_core_module.xml" id="client_max_body_size"/>.
The method is available in the
<link doc="../http/ngx_http_js_module.xml" id="js_access"/>
and
<link doc="../http/ngx_http_js_module.xml" id="js_content"/> directives.

<para>
The body is read once and cached on the request:
subsequent calls to
<link id="r_read_request_text"><literal>r.readRequestText()</literal></link>,
<link id="r_read_request_array_buffer"><literal>r.readRequestArrayBuffer()</literal></link>,
<link id="r_read_request_json"><literal>r.readRequestJSON()</literal></link>,
or
<link id="r_read_request_form"><literal>r.readRequestForm()</literal></link>
resolve from the cached body without re-reading the wire.
A second call issued while a previous read is still pending throws
<literal>"request body is already being read"</literal>.
</para>

<para>
Note that
it may convert bytes invalid in UTF-8 encoding into the replacement
character.
</para>
</tag-desc>

<tag-name id="r_request_body"><literal>r.requestBody</literal></tag-name>
<tag-desc>
the property was made obsolete in
Expand All @@ -395,6 +548,10 @@ and a sufficient buffer size should be set using
<link doc="../http/ngx_http_core_module.xml" id="client_body_buffer_size"/>.
The property is available only in the
<link doc="../http/ngx_http_js_module.xml" id="js_content"/> directive.
For asynchronous access, or for use in
<link doc="../http/ngx_http_js_module.xml" id="js_access"/>, see
<link id="r_read_request_text"><literal>r.readRequestText()</literal></link>
and other “<literal>r.readRequest*()</literal>” methods.
</tag-desc>

<tag-name id="r_request_text"><literal>r.requestText</literal></tag-name>
Expand All @@ -403,6 +560,9 @@ the same as <link id="r_request_buffer"><literal>r.requestBuffer</literal></link
but returns a <literal>string</literal>.
Note that
it may convert bytes invalid in UTF-8 encoding into the replacement character.
For asynchronous access, or for use in
<link doc="../http/ngx_http_js_module.xml" id="js_access"/>, see
<link id="r_read_request_text"><literal>r.readRequestText()</literal></link>.
</tag-desc>

<tag-name id="r_raw_headers_in"><literal>r.rawHeadersIn[]</literal></tag-name>
Expand Down Expand Up @@ -486,6 +646,12 @@ with the specified <literal>status</literal> to the client.
The response can be a string or Buffer
(<link doc="changes.xml" id="njs0.5.0">0.5.0</link>).
<para>
May be called from the
<link doc="../http/ngx_http_js_module.xml" id="js_content"/>
or, since <link doc="changes.xml" id="njs0.9.9">0.9.9</link>,
<link doc="../http/ngx_http_js_module.xml" id="js_access"/> handler.
</para>
<para>
It is possible to specify either a redirect URL
(for codes 301, 302, 303, 307, and 308)
or the response body text (for other codes) as the second argument
Expand Down
Loading