[{"data":1,"prerenderedAt":888},["ShallowReactive",2],{"navigation":3,"-utils-security":189,"-utils-security-surround":883},[4,91,138,166,173],{"title":5,"path":6,"stem":7,"children":8,"icon":90},"Guide","/guide","1.guide/0.index",[9,12,53,69],{"title":10,"path":6,"stem":7,"icon":11},"Getting Started","pixel:play",{"title":5,"icon":13,"path":14,"stem":15,"children":16,"page":52},"ph:book-open-duotone","/guide/basics","1.guide/1.basics",[17,22,27,32,37,42,47],{"title":18,"path":19,"stem":20,"icon":21},"Request Lifecycle","/guide/basics/lifecycle","1.guide/1.basics/1.lifecycle","icon-park-outline:handle-round",{"title":23,"path":24,"stem":25,"icon":26},"Routing","/guide/basics/routing","1.guide/1.basics/2.routing","solar:routing-bold",{"title":28,"path":29,"stem":30,"icon":31},"Middleware","/guide/basics/middleware","1.guide/1.basics/3.middleware","mdi:middleware-outline",{"title":33,"path":34,"stem":35,"icon":36},"Event Handlers","/guide/basics/handler","1.guide/1.basics/4.handler","mdi:function",{"title":38,"path":39,"stem":40,"icon":41},"Sending Response","/guide/basics/response","1.guide/1.basics/5.response","tabler:json",{"title":43,"path":44,"stem":45,"icon":46},"Error Handling","/guide/basics/error","1.guide/1.basics/6.error","tabler:error-404",{"title":48,"path":49,"stem":50,"icon":51},"Nested Apps","/guide/basics/nested-apps","1.guide/1.basics/7.nested-apps","material-symbols-light:layers-outline",false,{"title":54,"icon":55,"path":56,"stem":57,"children":58,"page":52},"API","material-symbols-light:api-rounded","/guide/api","1.guide/900.api",[59,64],{"title":60,"path":61,"stem":62,"icon":63},"H3","/guide/api/h3","1.guide/900.api/1.h3","material-symbols:bolt-rounded",{"title":65,"path":66,"stem":67,"icon":68},"H3Event","/guide/api/h3event","1.guide/900.api/2.h3event","material-symbols:data-object-rounded",{"title":70,"icon":71,"path":72,"stem":73,"children":74,"page":52},"Advanced","hugeicons:more-01","/guide/advanced","1.guide/901.advanced",[75,80,85],{"title":76,"path":77,"stem":78,"icon":79},"Plugins","/guide/advanced/plugins","1.guide/901.advanced/1.plugins","clarity:plugin-line",{"title":81,"path":82,"stem":83,"icon":84},"WebSockets","/guide/advanced/websocket","1.guide/901.advanced/2.websocket","hugeicons:live-streaming-02",{"title":86,"path":87,"stem":88,"icon":89},"Nightly Builds","/guide/advanced/nightly","1.guide/901.advanced/9.nightly","game-icons:barn-owl","i-ph:book-open-duotone",{"title":92,"path":93,"stem":94,"children":95,"icon":97},"Utils","/utils","2.utils/0.index",[96,98,103,108,113,118,123,128,133],{"title":92,"path":93,"stem":94,"icon":97},"ph:function-bold",{"title":99,"path":100,"stem":101,"icon":102},"Request","/utils/request","2.utils/1.request","material-symbols-light:input",{"title":104,"path":105,"stem":106,"icon":107},"Response","/utils/response","2.utils/2.response","material-symbols-light:output",{"title":109,"path":110,"stem":111,"icon":112},"Cookie","/utils/cookie","2.utils/3.cookie","material-symbols:cookie-outline",{"title":114,"path":115,"stem":116,"icon":117},"Security","/utils/security","2.utils/4.security","wpf:key-security",{"title":119,"path":120,"stem":121,"icon":122},"Proxy","/utils/proxy","2.utils/5.proxy","arcticons:super-proxy",{"title":124,"path":125,"stem":126,"icon":127},"MCP","/utils/mcp","2.utils/6.mcp","material-symbols:swap-calls",{"title":129,"path":130,"stem":131,"icon":132},"More utils","/utils/more","2.utils/9.more","mingcute:plus-line",{"title":134,"path":135,"stem":136,"icon":137},"Community","/utils/community","2.utils/99.community","lets-icons:external",{"title":139,"path":140,"stem":141,"children":142,"icon":144},"Examples","/examples","4.examples/0.index",[143,145,150,154,158,162],{"title":139,"path":140,"stem":141,"icon":144},"ph:code",{"title":146,"path":147,"stem":148,"icon":149},"Cookies","/examples/handle-cookie","4.examples/handle-cookie","ph:arrow-right",{"title":151,"path":152,"stem":153,"icon":149},"Sessions","/examples/handle-session","4.examples/handle-session",{"title":155,"path":156,"stem":157,"icon":149},"Static Assets","/examples/serve-static-assets","4.examples/serve-static-assets",{"title":159,"path":160,"stem":161,"icon":149},"Stream Response","/examples/stream-response","4.examples/stream-response",{"title":163,"path":164,"stem":165,"icon":149},"Validate Data","/examples/validate-data","4.examples/validate-data",{"title":167,"path":168,"stem":169,"children":170,"icon":172},"Migration","/migration","5.migration/0.index",[171],{"title":167,"path":168,"stem":169,"icon":172},"icons8:up-round",{"title":174,"path":175,"stem":176,"children":177},"Blog","/blog","99.blog",[178,181,185],{"title":174,"path":175,"stem":179,"icon":180},"99.blog/index","i-lucide-file-text",{"title":182,"path":183,"stem":184,"icon":180},"H3 1.8 - Towards the Edge of the Web","/blog/v1.8","99.blog/1.v1.8",{"title":186,"path":187,"stem":188,"icon":180},"H3 v2 beta","/blog/v2-beta","99.blog/2.v2-beta",{"id":190,"title":114,"body":191,"description":876,"extension":877,"meta":878,"navigation":880,"path":115,"seo":881,"stem":116,"__hash__":882},"content/2.utils/4.security.md",{"type":192,"value":193,"toc":849,"icon":117},"minimark",[194,199,207,211,217,345,351,354,358,451,455,461,464,470,473,479,482,488,491,497,500,506,509,513,519,522,526,532,535,541,544,550,553,556,563,567,726,732,735,741,744,748,754,775,806,815,845],[195,196,198],"h2",{"id":197},"authentication","Authentication",[200,201,203],"h3",{"id":202},"basicauthopts",[204,205,206],"code",{},"basicAuth(opts)",[208,209,210],"p",{},"Create a basic authentication middleware.",[208,212,213],{},[214,215,216],"strong",{},"Example:",[218,219,224],"pre",{"className":220,"code":221,"language":222,"meta":223,"style":223},"language-ts shiki shiki-themes github-light github-dark github-dark","import { H3, serve, basicAuth } from \"h3\";\nconst auth = basicAuth({ password: \"test\" });\napp.get(\"/\", (event) => `Hello ${event.context.basicAuth?.username}!`, [auth]);\nserve(app, { port: 3000 });\n","ts","",[204,225,226,249,275,331],{"__ignoreMap":223},[227,228,231,235,239,242,246],"span",{"class":229,"line":230},"line",1,[227,232,234],{"class":233},"so5gQ","import",[227,236,238],{"class":237},"slsVL"," { H3, serve, basicAuth } ",[227,240,241],{"class":233},"from",[227,243,245],{"class":244},"sfrk1"," \"h3\"",[227,247,248],{"class":237},";\n",[227,250,252,255,259,262,266,269,272],{"class":229,"line":251},2,[227,253,254],{"class":233},"const",[227,256,258],{"class":257},"suiK_"," auth",[227,260,261],{"class":233}," =",[227,263,265],{"class":264},"shcOC"," basicAuth",[227,267,268],{"class":237},"({ password: ",[227,270,271],{"class":244},"\"test\"",[227,273,274],{"class":237}," });\n",[227,276,278,281,284,287,290,293,297,300,303,306,308,311,314,316,319,322,325,328],{"class":229,"line":277},3,[227,279,280],{"class":237},"app.",[227,282,283],{"class":264},"get",[227,285,286],{"class":237},"(",[227,288,289],{"class":244},"\"/\"",[227,291,292],{"class":237},", (",[227,294,296],{"class":295},"sQHwn","event",[227,298,299],{"class":237},") ",[227,301,302],{"class":233},"=>",[227,304,305],{"class":244}," `Hello ${",[227,307,296],{"class":237},[227,309,310],{"class":244},".",[227,312,313],{"class":237},"context",[227,315,310],{"class":244},[227,317,318],{"class":237},"basicAuth",[227,320,321],{"class":244},"?.",[227,323,324],{"class":237},"username",[227,326,327],{"class":244},"}!`",[227,329,330],{"class":237},", [auth]);\n",[227,332,334,337,340,343],{"class":229,"line":333},4,[227,335,336],{"class":264},"serve",[227,338,339],{"class":237},"(app, { port: ",[227,341,342],{"class":257},"3000",[227,344,274],{"class":237},[200,346,348],{"id":347},"requirebasicauthevent-opts",[204,349,350],{},"requireBasicAuth(event, opts)",[208,352,353],{},"Apply basic authentication for current request.",[208,355,356],{},[214,357,216],{},[218,359,361],{"className":220,"code":360,"language":222,"meta":223,"style":223},"import { defineHandler, requireBasicAuth } from \"h3\";\nexport default defineHandler(async (event) => {\n  await requireBasicAuth(event, { password: \"test\" });\n  return `Hello, ${event.context.basicAuth.username}!`;\n});\n",[204,362,363,376,404,419,445],{"__ignoreMap":223},[227,364,365,367,370,372,374],{"class":229,"line":230},[227,366,234],{"class":233},[227,368,369],{"class":237}," { defineHandler, requireBasicAuth } ",[227,371,241],{"class":233},[227,373,245],{"class":244},[227,375,248],{"class":237},[227,377,378,381,384,387,389,392,395,397,399,401],{"class":229,"line":251},[227,379,380],{"class":233},"export",[227,382,383],{"class":233}," default",[227,385,386],{"class":264}," defineHandler",[227,388,286],{"class":237},[227,390,391],{"class":233},"async",[227,393,394],{"class":237}," (",[227,396,296],{"class":295},[227,398,299],{"class":237},[227,400,302],{"class":233},[227,402,403],{"class":237}," {\n",[227,405,406,409,412,415,417],{"class":229,"line":277},[227,407,408],{"class":233},"  await",[227,410,411],{"class":264}," requireBasicAuth",[227,413,414],{"class":237},"(event, { password: ",[227,416,271],{"class":244},[227,418,274],{"class":237},[227,420,421,424,427,429,431,433,435,437,439,441,443],{"class":229,"line":333},[227,422,423],{"class":233},"  return",[227,425,426],{"class":244}," `Hello, ${",[227,428,296],{"class":237},[227,430,310],{"class":244},[227,432,313],{"class":237},[227,434,310],{"class":244},[227,436,318],{"class":237},[227,438,310],{"class":244},[227,440,324],{"class":237},[227,442,327],{"class":244},[227,444,248],{"class":237},[227,446,448],{"class":229,"line":447},5,[227,449,450],{"class":237},"});\n",[195,452,454],{"id":453},"session","Session",[200,456,458],{"id":457},"clearsessionevent-config",[204,459,460],{},"clearSession(event, config)",[208,462,463],{},"Clear the session data for the current request.",[200,465,467],{"id":466},"getsessionevent-config",[204,468,469],{},"getSession(event, config)",[208,471,472],{},"Get the session for the current request.",[200,474,476],{"id":475},"sealsessionevent-config",[204,477,478],{},"sealSession(event, config)",[208,480,481],{},"Encrypt and sign the session data for the current request.",[200,483,485],{"id":484},"unsealsession_event-config-sealed",[204,486,487],{},"unsealSession(_event, config, sealed)",[208,489,490],{},"Decrypt and verify the session data for the current request.",[200,492,494],{"id":493},"updatesessionevent-config-update",[204,495,496],{},"updateSession(event, config, update?)",[208,498,499],{},"Update the session data for the current request.",[200,501,503],{"id":502},"usesessionevent-config",[204,504,505],{},"useSession(event, config)",[208,507,508],{},"Create a session manager for the current request.",[195,510,512],{"id":511},"fingerprint","Fingerprint",[200,514,516],{"id":515},"getrequestfingerprintevent-opts",[204,517,518],{},"getRequestFingerprint(event, opts)",[208,520,521],{},"Get a unique fingerprint for the incoming request.",[195,523,525],{"id":524},"cors","CORS",[200,527,529],{"id":528},"appendcorsheadersevent-options",[204,530,531],{},"appendCorsHeaders(event, options)",[208,533,534],{},"Append CORS headers to the response.",[200,536,538],{"id":537},"appendcorspreflightheadersevent-options",[204,539,540],{},"appendCorsPreflightHeaders(event, options)",[208,542,543],{},"Append CORS preflight headers to the response.",[200,545,547],{"id":546},"handlecorsevent-options",[204,548,549],{},"handleCors(event, options)",[208,551,552],{},"Handle CORS for the incoming request.",[208,554,555],{},"If the incoming request is a CORS preflight request, it will append the CORS preflight headers and send a 204 response.",[208,557,558,559,562],{},"If return value is not ",[204,560,561],{},"false",", the request is handled and no further action is needed.",[208,564,565],{},[214,566,216],{},[218,568,570],{"className":220,"code":569,"language":222,"meta":223,"style":223},"const app = new H3();\napp.all(\"/\", async (event) => {\n  const corsRes = handleCors(event, {\n    origin: \"*\",\n    preflight: {\n      statusCode: 204,\n    },\n    methods: \"*\",\n  });\n  if (corsRes !== false) {\n    return corsRes;\n  }\n  // Your code here\n});\n",[204,571,572,590,616,632,643,648,659,665,675,681,699,708,714,721],{"__ignoreMap":223},[227,573,574,576,579,581,584,587],{"class":229,"line":230},[227,575,254],{"class":233},[227,577,578],{"class":257}," app",[227,580,261],{"class":233},[227,582,583],{"class":233}," new",[227,585,586],{"class":264}," H3",[227,588,589],{"class":237},"();\n",[227,591,592,594,597,599,601,604,606,608,610,612,614],{"class":229,"line":251},[227,593,280],{"class":237},[227,595,596],{"class":264},"all",[227,598,286],{"class":237},[227,600,289],{"class":244},[227,602,603],{"class":237},", ",[227,605,391],{"class":233},[227,607,394],{"class":237},[227,609,296],{"class":295},[227,611,299],{"class":237},[227,613,302],{"class":233},[227,615,403],{"class":237},[227,617,618,621,624,626,629],{"class":229,"line":277},[227,619,620],{"class":233},"  const",[227,622,623],{"class":257}," corsRes",[227,625,261],{"class":233},[227,627,628],{"class":264}," handleCors",[227,630,631],{"class":237},"(event, {\n",[227,633,634,637,640],{"class":229,"line":333},[227,635,636],{"class":237},"    origin: ",[227,638,639],{"class":244},"\"*\"",[227,641,642],{"class":237},",\n",[227,644,645],{"class":229,"line":447},[227,646,647],{"class":237},"    preflight: {\n",[227,649,651,654,657],{"class":229,"line":650},6,[227,652,653],{"class":237},"      statusCode: ",[227,655,656],{"class":257},"204",[227,658,642],{"class":237},[227,660,662],{"class":229,"line":661},7,[227,663,664],{"class":237},"    },\n",[227,666,668,671,673],{"class":229,"line":667},8,[227,669,670],{"class":237},"    methods: ",[227,672,639],{"class":244},[227,674,642],{"class":237},[227,676,678],{"class":229,"line":677},9,[227,679,680],{"class":237},"  });\n",[227,682,684,687,690,693,696],{"class":229,"line":683},10,[227,685,686],{"class":233},"  if",[227,688,689],{"class":237}," (corsRes ",[227,691,692],{"class":233},"!==",[227,694,695],{"class":257}," false",[227,697,698],{"class":237},") {\n",[227,700,702,705],{"class":229,"line":701},11,[227,703,704],{"class":233},"    return",[227,706,707],{"class":237}," corsRes;\n",[227,709,711],{"class":229,"line":710},12,[227,712,713],{"class":237},"  }\n",[227,715,717],{"class":229,"line":716},13,[227,718,720],{"class":719},"sCsY4","  // Your code here\n",[227,722,724],{"class":229,"line":723},14,[227,725,450],{"class":237},[200,727,729],{"id":728},"iscorsoriginallowedorigin-options",[204,730,731],{},"isCorsOriginAllowed(origin, options)",[208,733,734],{},"Check if the origin is allowed.",[200,736,738],{"id":737},"ispreflightrequestevent",[204,739,740],{},"isPreflightRequest(event)",[208,742,743],{},"Check if the incoming request is a CORS preflight request.",[195,745,747],{"id":746},"path","Path",[200,749,751],{"id":750},"resolvedotsegmentspath-opts",[204,752,753],{},"resolveDotSegments(path, opts?)",[208,755,756,757,759,760,763,764,767,768,770,771,774],{},"Resolve ",[204,758,310],{}," and ",[204,761,762],{},".."," segments in a path, without ever escaping above the root ",[204,765,766],{},"/",". The result is always an absolute path with a single leading ",[204,769,766],{},", so it can never be protocol-relative (",[204,772,773],{},"//host",").",[208,776,777,778,781,782,603,785,788,789,792,793,795,796,603,799,802,803,310],{},"Also decodes percent-encoded dot segments at any ",[204,779,780],{},"%25","-nesting depth (",[204,783,784],{},"%2e",[204,786,787],{},"%252e",", ...) and normalizes ",[204,790,791],{},"\\"," to ",[204,794,766],{},", so encoded or backslash-based traversal (e.g. ",[204,797,798],{},"%2e%2e/",[204,800,801],{},"..\\..\\",") is caught the same way as a literal ",[204,804,805],{},"../",[208,807,808,766,811,814],{},[204,809,810],{},"%2f",[204,812,813],{},"%5c"," (encoded path separators) are left untouched by default — see {@link ResolveDotSegmentsOptions.decodeSlashes}.",[208,816,817,818,766,820,822,823,826,827,830,831,833,834,837,838,841,842,844],{},"Only ",[204,819,310],{},[204,821,762],{}," resolution and the decodes above alter the string; every other percent-encoding (",[204,824,825],{},"%20",", non-ASCII, ",[204,828,829],{},"%3A",", and any ",[204,832,784],{}," not forming a whole segment) is left intact, so the result stays in the same representation as an un-decoded ",[204,835,836],{},"event.url.pathname"," and matches routes/rules consistently. Interior empty segments are preserved (",[204,839,840],{},"/a//b"," stays ",[204,843,840],{},", per WHATWG URL normalization) — only the leading slash is guaranteed single, so a consumer doing exact prefix matching should normalize its allowlist the same way.",[846,847,848],"style",{},"html pre.shiki code .so5gQ, html code.shiki .so5gQ{--shiki-light:#D73A49;--shiki-default:#F97583;--shiki-dark:#F97583}html pre.shiki code .slsVL, html code.shiki .slsVL{--shiki-light:#24292E;--shiki-default:#E1E4E8;--shiki-dark:#E1E4E8}html pre.shiki code .sfrk1, html code.shiki .sfrk1{--shiki-light:#032F62;--shiki-default:#9ECBFF;--shiki-dark:#9ECBFF}html pre.shiki code .suiK_, html code.shiki .suiK_{--shiki-light:#005CC5;--shiki-default:#79B8FF;--shiki-dark:#79B8FF}html pre.shiki code .shcOC, html code.shiki .shcOC{--shiki-light:#6F42C1;--shiki-default:#B392F0;--shiki-dark:#B392F0}html pre.shiki code .sQHwn, html code.shiki .sQHwn{--shiki-light:#E36209;--shiki-default:#FFAB70;--shiki-dark:#FFAB70}html .light .shiki span {color: var(--shiki-light);background: var(--shiki-light-bg);font-style: var(--shiki-light-font-style);font-weight: var(--shiki-light-font-weight);text-decoration: var(--shiki-light-text-decoration);}html.light .shiki span {color: var(--shiki-light);background: var(--shiki-light-bg);font-style: var(--shiki-light-font-style);font-weight: var(--shiki-light-font-weight);text-decoration: var(--shiki-light-text-decoration);}html .default .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}html.dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}html pre.shiki code .sCsY4, html code.shiki .sCsY4{--shiki-light:#6A737D;--shiki-default:#6A737D;--shiki-dark:#6A737D}",{"title":223,"searchDepth":251,"depth":251,"links":850},[851,855,863,866,873],{"id":197,"depth":251,"text":198,"children":852},[853,854],{"id":202,"depth":277,"text":206},{"id":347,"depth":277,"text":350},{"id":453,"depth":251,"text":454,"children":856},[857,858,859,860,861,862],{"id":457,"depth":277,"text":460},{"id":466,"depth":277,"text":469},{"id":475,"depth":277,"text":478},{"id":484,"depth":277,"text":487},{"id":493,"depth":277,"text":496},{"id":502,"depth":277,"text":505},{"id":511,"depth":251,"text":512,"children":864},[865],{"id":515,"depth":277,"text":518},{"id":524,"depth":251,"text":525,"children":867},[868,869,870,871,872],{"id":528,"depth":277,"text":531},{"id":537,"depth":277,"text":540},{"id":546,"depth":277,"text":549},{"id":728,"depth":277,"text":731},{"id":737,"depth":277,"text":740},{"id":746,"depth":251,"text":747,"children":874},[875],{"id":750,"depth":277,"text":753},"H3 security utilities.","md",{"automd":879,"icon":117},true,{"icon":117},{"title":114,"description":876},"h7X4aE_5ofV44oJoNxJFup1a2NMHTSDjDb5rOadRvC4",[884,886],{"title":109,"path":110,"stem":111,"description":885,"icon":112,"children":-1},"H3 cookie utilities.",{"title":119,"path":120,"stem":121,"description":887,"icon":122,"children":-1},"H3 proxy utilities.",1783115412056]