[{"data":1,"prerenderedAt":892},["ShallowReactive",2],{"navigation":3,"-utils-security":193,"-utils-security-surround":887},[4,91,138,170,177],{"title":5,"path":6,"stem":7,"children":8,"icon":90},"Guide","/guide","1.guide/0.index",[9,12,53,69],{"title":10,"path":6,"stem":7,"icon":11},"Getting Started","pixel:play",{"title":5,"icon":13,"path":14,"stem":15,"children":16,"page":52},"ph:book-open-duotone","/guide/basics","1.guide/1.basics",[17,22,27,32,37,42,47],{"title":18,"path":19,"stem":20,"icon":21},"Request Lifecycle","/guide/basics/lifecycle","1.guide/1.basics/1.lifecycle","icon-park-outline:handle-round",{"title":23,"path":24,"stem":25,"icon":26},"Routing","/guide/basics/routing","1.guide/1.basics/2.routing","solar:routing-bold",{"title":28,"path":29,"stem":30,"icon":31},"Middleware","/guide/basics/middleware","1.guide/1.basics/3.middleware","mdi:middleware-outline",{"title":33,"path":34,"stem":35,"icon":36},"Event Handlers","/guide/basics/handler","1.guide/1.basics/4.handler","mdi:function",{"title":38,"path":39,"stem":40,"icon":41},"Sending Response","/guide/basics/response","1.guide/1.basics/5.response","tabler:json",{"title":43,"path":44,"stem":45,"icon":46},"Error Handling","/guide/basics/error","1.guide/1.basics/6.error","tabler:error-404",{"title":48,"path":49,"stem":50,"icon":51},"Nested Apps","/guide/basics/nested-apps","1.guide/1.basics/7.nested-apps","material-symbols-light:layers-outline",false,{"title":54,"icon":55,"path":56,"stem":57,"children":58,"page":52},"API","material-symbols-light:api-rounded","/guide/api","1.guide/900.api",[59,64],{"title":60,"path":61,"stem":62,"icon":63},"H3","/guide/api/h3","1.guide/900.api/1.h3","material-symbols:bolt-rounded",{"title":65,"path":66,"stem":67,"icon":68},"H3Event","/guide/api/h3event","1.guide/900.api/2.h3event","material-symbols:data-object-rounded",{"title":70,"icon":71,"path":72,"stem":73,"children":74,"page":52},"Advanced","hugeicons:more-01","/guide/advanced","1.guide/901.advanced",[75,80,85],{"title":76,"path":77,"stem":78,"icon":79},"Plugins","/guide/advanced/plugins","1.guide/901.advanced/1.plugins","clarity:plugin-line",{"title":81,"path":82,"stem":83,"icon":84},"WebSockets","/guide/advanced/websocket","1.guide/901.advanced/2.websocket","hugeicons:live-streaming-02",{"title":86,"path":87,"stem":88,"icon":89},"Nightly Builds","/guide/advanced/nightly","1.guide/901.advanced/9.nightly","game-icons:barn-owl","i-ph:book-open-duotone",{"title":92,"path":93,"stem":94,"children":95,"icon":97},"Utils","/utils","2.utils/0.index",[96,98,103,108,113,118,123,128,133],{"title":92,"path":93,"stem":94,"icon":97},"ph:function-bold",{"title":99,"path":100,"stem":101,"icon":102},"Request","/utils/request","2.utils/1.request","material-symbols-light:input",{"title":104,"path":105,"stem":106,"icon":107},"Response","/utils/response","2.utils/2.response","material-symbols-light:output",{"title":109,"path":110,"stem":111,"icon":112},"Cookie","/utils/cookie","2.utils/3.cookie","material-symbols:cookie-outline",{"title":114,"path":115,"stem":116,"icon":117},"Security","/utils/security","2.utils/4.security","wpf:key-security",{"title":119,"path":120,"stem":121,"icon":122},"Proxy","/utils/proxy","2.utils/5.proxy","arcticons:super-proxy",{"title":124,"path":125,"stem":126,"icon":127},"MCP","/utils/mcp","2.utils/6.mcp","material-symbols:swap-calls",{"title":129,"path":130,"stem":131,"icon":132},"More utils","/utils/more","2.utils/9.more","mingcute:plus-line",{"title":134,"path":135,"stem":136,"icon":137},"Community","/utils/community","2.utils/99.community","lets-icons:external",{"title":139,"path":140,"stem":141,"children":142,"icon":144},"Examples","/examples","4.examples/0.index",[143,145,150,154,158,162,166],{"title":139,"path":140,"stem":141,"icon":144},"ph:code",{"title":146,"path":147,"stem":148,"icon":149},"Cookies","/examples/handle-cookie","4.examples/handle-cookie","ph:arrow-right",{"title":151,"path":152,"stem":153,"icon":149},"HTTP QUERY Method","/examples/handle-query","4.examples/handle-query",{"title":155,"path":156,"stem":157,"icon":149},"Sessions","/examples/handle-session","4.examples/handle-session",{"title":159,"path":160,"stem":161,"icon":149},"Static Assets","/examples/serve-static-assets","4.examples/serve-static-assets",{"title":163,"path":164,"stem":165,"icon":149},"Stream Response","/examples/stream-response","4.examples/stream-response",{"title":167,"path":168,"stem":169,"icon":149},"Validate Data","/examples/validate-data","4.examples/validate-data",{"title":171,"path":172,"stem":173,"children":174,"icon":176},"Migration","/migration","5.migration/0.index",[175],{"title":171,"path":172,"stem":173,"icon":176},"icons8:up-round",{"title":178,"path":179,"stem":180,"children":181},"Blog","/blog","99.blog",[182,185,189],{"title":178,"path":179,"stem":183,"icon":184},"99.blog/index","i-lucide-file-text",{"title":186,"path":187,"stem":188,"icon":184},"H3 1.8 - Towards the Edge of the Web","/blog/v1.8","99.blog/1.v1.8",{"title":190,"path":191,"stem":192,"icon":184},"H3 v2 beta","/blog/v2-beta","99.blog/2.v2-beta",{"id":194,"title":114,"body":195,"description":880,"extension":881,"meta":882,"navigation":884,"path":115,"seo":885,"stem":116,"__hash__":886},"content/2.utils/4.security.md",{"type":196,"value":197,"toc":853,"icon":117},"minimark",[198,203,211,215,221,349,355,358,362,455,459,465,468,474,477,483,486,492,495,501,504,510,513,517,523,526,530,536,539,545,548,554,557,560,567,571,730,736,739,745,748,752,758,779,810,819,849],[199,200,202],"h2",{"id":201},"authentication","Authentication",[204,205,207],"h3",{"id":206},"basicauthopts",[208,209,210],"code",{},"basicAuth(opts)",[212,213,214],"p",{},"Create a basic authentication middleware.",[212,216,217],{},[218,219,220],"strong",{},"Example:",[222,223,228],"pre",{"className":224,"code":225,"language":226,"meta":227,"style":227},"language-ts shiki shiki-themes github-light github-dark github-dark","import { H3, serve, basicAuth } from \"h3\";\nconst auth = basicAuth({ password: \"test\" });\napp.get(\"/\", (event) => `Hello ${event.context.basicAuth?.username}!`, [auth]);\nserve(app, { port: 3000 });\n","ts","",[208,229,230,253,279,335],{"__ignoreMap":227},[231,232,235,239,243,246,250],"span",{"class":233,"line":234},"line",1,[231,236,238],{"class":237},"so5gQ","import",[231,240,242],{"class":241},"slsVL"," { H3, serve, basicAuth } ",[231,244,245],{"class":237},"from",[231,247,249],{"class":248},"sfrk1"," \"h3\"",[231,251,252],{"class":241},";\n",[231,254,256,259,263,266,270,273,276],{"class":233,"line":255},2,[231,257,258],{"class":237},"const",[231,260,262],{"class":261},"suiK_"," auth",[231,264,265],{"class":237}," =",[231,267,269],{"class":268},"shcOC"," basicAuth",[231,271,272],{"class":241},"({ password: ",[231,274,275],{"class":248},"\"test\"",[231,277,278],{"class":241}," });\n",[231,280,282,285,288,291,294,297,301,304,307,310,312,315,318,320,323,326,329,332],{"class":233,"line":281},3,[231,283,284],{"class":241},"app.",[231,286,287],{"class":268},"get",[231,289,290],{"class":241},"(",[231,292,293],{"class":248},"\"/\"",[231,295,296],{"class":241},", (",[231,298,300],{"class":299},"sQHwn","event",[231,302,303],{"class":241},") ",[231,305,306],{"class":237},"=>",[231,308,309],{"class":248}," `Hello ${",[231,311,300],{"class":241},[231,313,314],{"class":248},".",[231,316,317],{"class":241},"context",[231,319,314],{"class":248},[231,321,322],{"class":241},"basicAuth",[231,324,325],{"class":248},"?.",[231,327,328],{"class":241},"username",[231,330,331],{"class":248},"}!`",[231,333,334],{"class":241},", [auth]);\n",[231,336,338,341,344,347],{"class":233,"line":337},4,[231,339,340],{"class":268},"serve",[231,342,343],{"class":241},"(app, { port: ",[231,345,346],{"class":261},"3000",[231,348,278],{"class":241},[204,350,352],{"id":351},"requirebasicauthevent-opts",[208,353,354],{},"requireBasicAuth(event, opts)",[212,356,357],{},"Apply basic authentication for current request.",[212,359,360],{},[218,361,220],{},[222,363,365],{"className":224,"code":364,"language":226,"meta":227,"style":227},"import { defineHandler, requireBasicAuth } from \"h3\";\nexport default defineHandler(async (event) => {\n  await requireBasicAuth(event, { password: \"test\" });\n  return `Hello, ${event.context.basicAuth.username}!`;\n});\n",[208,366,367,380,408,423,449],{"__ignoreMap":227},[231,368,369,371,374,376,378],{"class":233,"line":234},[231,370,238],{"class":237},[231,372,373],{"class":241}," { defineHandler, requireBasicAuth } ",[231,375,245],{"class":237},[231,377,249],{"class":248},[231,379,252],{"class":241},[231,381,382,385,388,391,393,396,399,401,403,405],{"class":233,"line":255},[231,383,384],{"class":237},"export",[231,386,387],{"class":237}," default",[231,389,390],{"class":268}," defineHandler",[231,392,290],{"class":241},[231,394,395],{"class":237},"async",[231,397,398],{"class":241}," (",[231,400,300],{"class":299},[231,402,303],{"class":241},[231,404,306],{"class":237},[231,406,407],{"class":241}," {\n",[231,409,410,413,416,419,421],{"class":233,"line":281},[231,411,412],{"class":237},"  await",[231,414,415],{"class":268}," requireBasicAuth",[231,417,418],{"class":241},"(event, { password: ",[231,420,275],{"class":248},[231,422,278],{"class":241},[231,424,425,428,431,433,435,437,439,441,443,445,447],{"class":233,"line":337},[231,426,427],{"class":237},"  return",[231,429,430],{"class":248}," `Hello, ${",[231,432,300],{"class":241},[231,434,314],{"class":248},[231,436,317],{"class":241},[231,438,314],{"class":248},[231,440,322],{"class":241},[231,442,314],{"class":248},[231,444,328],{"class":241},[231,446,331],{"class":248},[231,448,252],{"class":241},[231,450,452],{"class":233,"line":451},5,[231,453,454],{"class":241},"});\n",[199,456,458],{"id":457},"session","Session",[204,460,462],{"id":461},"clearsessionevent-config",[208,463,464],{},"clearSession(event, config)",[212,466,467],{},"Clear the session data for the current request.",[204,469,471],{"id":470},"getsessionevent-config",[208,472,473],{},"getSession(event, config)",[212,475,476],{},"Get the session for the current request.",[204,478,480],{"id":479},"sealsessionevent-config",[208,481,482],{},"sealSession(event, config)",[212,484,485],{},"Encrypt and sign the session data for the current request.",[204,487,489],{"id":488},"unsealsession_event-config-sealed",[208,490,491],{},"unsealSession(_event, config, sealed)",[212,493,494],{},"Decrypt and verify the session data for the current request.",[204,496,498],{"id":497},"updatesessionevent-config-update",[208,499,500],{},"updateSession(event, config, update?)",[212,502,503],{},"Update the session data for the current request.",[204,505,507],{"id":506},"usesessionevent-config",[208,508,509],{},"useSession(event, config)",[212,511,512],{},"Create a session manager for the current request.",[199,514,516],{"id":515},"fingerprint","Fingerprint",[204,518,520],{"id":519},"getrequestfingerprintevent-opts",[208,521,522],{},"getRequestFingerprint(event, opts)",[212,524,525],{},"Get a unique fingerprint for the incoming request.",[199,527,529],{"id":528},"cors","CORS",[204,531,533],{"id":532},"appendcorsheadersevent-options",[208,534,535],{},"appendCorsHeaders(event, options)",[212,537,538],{},"Append CORS headers to the response.",[204,540,542],{"id":541},"appendcorspreflightheadersevent-options",[208,543,544],{},"appendCorsPreflightHeaders(event, options)",[212,546,547],{},"Append CORS preflight headers to the response.",[204,549,551],{"id":550},"handlecorsevent-options",[208,552,553],{},"handleCors(event, options)",[212,555,556],{},"Handle CORS for the incoming request.",[212,558,559],{},"If the incoming request is a CORS preflight request, it will append the CORS preflight headers and send a 204 response.",[212,561,562,563,566],{},"If return value is not ",[208,564,565],{},"false",", the request is handled and no further action is needed.",[212,568,569],{},[218,570,220],{},[222,572,574],{"className":224,"code":573,"language":226,"meta":227,"style":227},"const app = new H3();\napp.all(\"/\", async (event) => {\n  const corsRes = handleCors(event, {\n    origin: \"*\",\n    preflight: {\n      statusCode: 204,\n    },\n    methods: \"*\",\n  });\n  if (corsRes !== false) {\n    return corsRes;\n  }\n  // Your code here\n});\n",[208,575,576,594,620,636,647,652,663,669,679,685,703,712,718,725],{"__ignoreMap":227},[231,577,578,580,583,585,588,591],{"class":233,"line":234},[231,579,258],{"class":237},[231,581,582],{"class":261}," app",[231,584,265],{"class":237},[231,586,587],{"class":237}," new",[231,589,590],{"class":268}," H3",[231,592,593],{"class":241},"();\n",[231,595,596,598,601,603,605,608,610,612,614,616,618],{"class":233,"line":255},[231,597,284],{"class":241},[231,599,600],{"class":268},"all",[231,602,290],{"class":241},[231,604,293],{"class":248},[231,606,607],{"class":241},", ",[231,609,395],{"class":237},[231,611,398],{"class":241},[231,613,300],{"class":299},[231,615,303],{"class":241},[231,617,306],{"class":237},[231,619,407],{"class":241},[231,621,622,625,628,630,633],{"class":233,"line":281},[231,623,624],{"class":237},"  const",[231,626,627],{"class":261}," corsRes",[231,629,265],{"class":237},[231,631,632],{"class":268}," handleCors",[231,634,635],{"class":241},"(event, {\n",[231,637,638,641,644],{"class":233,"line":337},[231,639,640],{"class":241},"    origin: ",[231,642,643],{"class":248},"\"*\"",[231,645,646],{"class":241},",\n",[231,648,649],{"class":233,"line":451},[231,650,651],{"class":241},"    preflight: {\n",[231,653,655,658,661],{"class":233,"line":654},6,[231,656,657],{"class":241},"      statusCode: ",[231,659,660],{"class":261},"204",[231,662,646],{"class":241},[231,664,666],{"class":233,"line":665},7,[231,667,668],{"class":241},"    },\n",[231,670,672,675,677],{"class":233,"line":671},8,[231,673,674],{"class":241},"    methods: ",[231,676,643],{"class":248},[231,678,646],{"class":241},[231,680,682],{"class":233,"line":681},9,[231,683,684],{"class":241},"  });\n",[231,686,688,691,694,697,700],{"class":233,"line":687},10,[231,689,690],{"class":237},"  if",[231,692,693],{"class":241}," (corsRes ",[231,695,696],{"class":237},"!==",[231,698,699],{"class":261}," false",[231,701,702],{"class":241},") {\n",[231,704,706,709],{"class":233,"line":705},11,[231,707,708],{"class":237},"    return",[231,710,711],{"class":241}," corsRes;\n",[231,713,715],{"class":233,"line":714},12,[231,716,717],{"class":241},"  }\n",[231,719,721],{"class":233,"line":720},13,[231,722,724],{"class":723},"sCsY4","  // Your code here\n",[231,726,728],{"class":233,"line":727},14,[231,729,454],{"class":241},[204,731,733],{"id":732},"iscorsoriginallowedorigin-options",[208,734,735],{},"isCorsOriginAllowed(origin, options)",[212,737,738],{},"Check if the origin is allowed.",[204,740,742],{"id":741},"ispreflightrequestevent",[208,743,744],{},"isPreflightRequest(event)",[212,746,747],{},"Check if the incoming request is a CORS preflight request.",[199,749,751],{"id":750},"path","Path",[204,753,755],{"id":754},"resolvedotsegmentspath-opts",[208,756,757],{},"resolveDotSegments(path, opts?)",[212,759,760,761,763,764,767,768,771,772,774,775,778],{},"Resolve ",[208,762,314],{}," and ",[208,765,766],{},".."," segments in a path, without ever escaping above the root ",[208,769,770],{},"/",". The result is always an absolute path with a single leading ",[208,773,770],{},", so it can never be protocol-relative (",[208,776,777],{},"//host",").",[212,780,781,782,785,786,607,789,792,793,796,797,799,800,607,803,806,807,314],{},"Also decodes percent-encoded dot segments at any ",[208,783,784],{},"%25","-nesting depth (",[208,787,788],{},"%2e",[208,790,791],{},"%252e",", ...) and normalizes ",[208,794,795],{},"\\"," to ",[208,798,770],{},", so encoded or backslash-based traversal (e.g. ",[208,801,802],{},"%2e%2e/",[208,804,805],{},"..\\..\\",") is caught the same way as a literal ",[208,808,809],{},"../",[212,811,812,770,815,818],{},[208,813,814],{},"%2f",[208,816,817],{},"%5c"," (encoded path separators) are left untouched by default — see {@link ResolveDotSegmentsOptions.decodeSlashes}.",[212,820,821,822,770,824,826,827,830,831,834,835,837,838,841,842,845,846,848],{},"Only ",[208,823,314],{},[208,825,766],{}," resolution and the decodes above alter the string; every other percent-encoding (",[208,828,829],{},"%20",", non-ASCII, ",[208,832,833],{},"%3A",", and any ",[208,836,788],{}," not forming a whole segment) is left intact, so the result stays in the same representation as an un-decoded ",[208,839,840],{},"event.url.pathname"," and matches routes/rules consistently. Interior empty segments are preserved (",[208,843,844],{},"/a//b"," stays ",[208,847,844],{},", per WHATWG URL normalization) — only the leading slash is guaranteed single, so a consumer doing exact prefix matching should normalize its allowlist the same way.",[850,851,852],"style",{},"html pre.shiki code .so5gQ, html code.shiki .so5gQ{--shiki-light:#D73A49;--shiki-default:#F97583;--shiki-dark:#F97583}html pre.shiki code .slsVL, html code.shiki .slsVL{--shiki-light:#24292E;--shiki-default:#E1E4E8;--shiki-dark:#E1E4E8}html pre.shiki code .sfrk1, html code.shiki .sfrk1{--shiki-light:#032F62;--shiki-default:#9ECBFF;--shiki-dark:#9ECBFF}html pre.shiki code .suiK_, html code.shiki .suiK_{--shiki-light:#005CC5;--shiki-default:#79B8FF;--shiki-dark:#79B8FF}html pre.shiki code .shcOC, html code.shiki .shcOC{--shiki-light:#6F42C1;--shiki-default:#B392F0;--shiki-dark:#B392F0}html pre.shiki code .sQHwn, html code.shiki .sQHwn{--shiki-light:#E36209;--shiki-default:#FFAB70;--shiki-dark:#FFAB70}html .light .shiki span {color: var(--shiki-light);background: var(--shiki-light-bg);font-style: var(--shiki-light-font-style);font-weight: var(--shiki-light-font-weight);text-decoration: var(--shiki-light-text-decoration);}html.light .shiki span {color: var(--shiki-light);background: var(--shiki-light-bg);font-style: var(--shiki-light-font-style);font-weight: var(--shiki-light-font-weight);text-decoration: var(--shiki-light-text-decoration);}html .default .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}html.dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}html pre.shiki code .sCsY4, html code.shiki .sCsY4{--shiki-light:#6A737D;--shiki-default:#6A737D;--shiki-dark:#6A737D}",{"title":227,"searchDepth":255,"depth":255,"links":854},[855,859,867,870,877],{"id":201,"depth":255,"text":202,"children":856},[857,858],{"id":206,"depth":281,"text":210},{"id":351,"depth":281,"text":354},{"id":457,"depth":255,"text":458,"children":860},[861,862,863,864,865,866],{"id":461,"depth":281,"text":464},{"id":470,"depth":281,"text":473},{"id":479,"depth":281,"text":482},{"id":488,"depth":281,"text":491},{"id":497,"depth":281,"text":500},{"id":506,"depth":281,"text":509},{"id":515,"depth":255,"text":516,"children":868},[869],{"id":519,"depth":281,"text":522},{"id":528,"depth":255,"text":529,"children":871},[872,873,874,875,876],{"id":532,"depth":281,"text":535},{"id":541,"depth":281,"text":544},{"id":550,"depth":281,"text":553},{"id":732,"depth":281,"text":735},{"id":741,"depth":281,"text":744},{"id":750,"depth":255,"text":751,"children":878},[879],{"id":754,"depth":281,"text":757},"H3 security utilities.","md",{"automd":883,"icon":117},true,{"icon":117},{"title":114,"description":880},"h7X4aE_5ofV44oJoNxJFup1a2NMHTSDjDb5rOadRvC4",[888,890],{"title":109,"path":110,"stem":111,"description":889,"icon":112,"children":-1},"H3 cookie utilities.",{"title":119,"path":120,"stem":121,"description":891,"icon":122,"children":-1},"H3 proxy utilities.",1783690730138]