main/file: add support for custom headers to file serving #13

wryun · 2024-11-19T02:41:24Z

This allows us to set 'Cache-Control: no-cache', which makes it possible to develop LuCI JS without resorting to disabling the cache in the browser dev tools.

See: openwrt/luci#7059

If this was merged, the follow up to OpenWrt would look something like:

diff --git a/package/network/services/uhttpd/files/uhttpd.init b/package/network/services/uhttpd/files/uhttpd.init
index 89ca0c6c1d..3589024bbd 100755
--- a/package/network/services/uhttpd/files/uhttpd.init
+++ b/package/network/services/uhttpd/files/uhttpd.init
@@ -103,6 +103,10 @@ append_ucode_prefix() {
        fi
 }
 
+append_extra_header() {
+       procd_append_param command -z "$1"
+}
+
 start_instance()
 {
        UHTTPD_CERT=""
@@ -190,6 +194,8 @@ start_instance()
                procd_append_param command -I "$path"
        done
 
+       config_list_foreach "$cfg" extra_header append_extra_header
+
        config_get https "$cfg" listen_https
        config_get UHTTPD_KEY  "$cfg" key  /etc/uhttpd.key
        config_get UHTTPD_CERT "$cfg" cert /etc/uhttpd.crt

stokito · 2024-11-19T08:28:36Z

main.c

+				fprintf(stderr, "Error: invalid extra header (-z) - missing colon\n");
+				exit(1);
+			}
+			extra_header->header = strdup(optarg);


you may use the optarg without duplication, see the alias parsing above

Updated, thanks, though it scare me a little :)

stokito · 2024-11-19T08:34:07Z

main.c

+			}
+			if (strchr(optarg, ':') == NULL) {
+				fprintf(stderr, "Error: invalid extra header (-z) - missing colon\n");
+				exit(1);


I would rather not exit the whole webserver and lost access to Luci if the header is ivalid. But it looks like everywhere else the same behavior.

Good point, but I think if you're changing the webserver settings you should have the expectation you may mess it up and have an alternative access mechanism (i.e. ssh).

Generally yes, but here we in the embedded world. A user may lost an access to its router. In the same time if some header is not present and something was broken then it may be not so critical for a security.

As you pointed out, though, the general behaviour of bad options in uhttpd is that the server will not load, even if they're non-critical (e.g. missing 404 handler)... I guess I'm reluctant to change this unless someone else chimes in and says that it's the thing that's blocking a merge.

stokito

ok

This allows us to set 'Cache-Control: no-cache', which makes it possible to develop LuCI JS without resorting to disabling the cache in the browser dev tools. Signed-off-by: James Haggerty <james.haggerty@morsemicro.com>

This allows us to set something like: list extra_header 'Cache-Control: no-cache' And no longer run into issues with caching JS files during development. The intent would be to make the sync.py script automatically check/set this. See: openwrt/luci#7059 and openwrt/uhttpd#13 Approved-by: Evan Benn Approved-by: Lyall Beveridge

Neustradamus · 2025-07-07T07:57:31Z

@wryun: What is the situation of your PR?

wryun · 2025-07-14T05:31:35Z

@Neustradamus can you explain what you mean by 'the situation of your PR'? I'm just hoping someone merges it; I have no permissions on this (or any) OpenWrt repository.

Neustradamus · 2025-07-14T16:55:41Z

@wryun: It is ready to be merged?
OpenWrt team, @stokito can look it?

stokito · 2025-07-14T17:58:36Z

main.c

 		"	-d string       URL decode given string\n"
 		"	-r string       Specify basic auth realm\n"
 		"	-m string       MD5 crypt given string\n"
+		"	-z string       Add additional response header (can use multiple times)\n"


I would like to change the z to H with long opt --header. Similar to curl but also similarly to npm http-server, to thecoshman/http and miniserve

H is, unfortunately, already used (see getopt). longopts are not supported.

stokito · 2025-07-14T18:16:54Z

I don't have merge right and all my path(es?) to the uhttpd waiting years to be reviewed.

The uhttpd started as a replacement for the BusyBox httpd (here it contains the -m option) but now it has so many features that makes it too heavy for small routers (with 4mb space) but for larger routers it simply better to use the Lighttpd. Some options I would better to remove.
I'm not against the feature, just want to clarify why would we need it:

Specify cache header. The uhttpd has cache validation with ETag so this is not really important.
CORS headers: this anyway won't help, the CORS headers are stupidly designed and they'll need for some code to set the Access-Control-Allow-Origin: example.com with the explicit domain from Origin. That's why the mini servers have a separate option to enable CORS: the [npm http-server] has --cors option, dufs has --enable-cors, serverino maybe some others.
Content-Security-Policy (CSP) header may be useful but it usually can't be made generic for all pages, it should be specified by the Web App itself but this means to use something like .htaccess with all it's downsides.
Maybe I missed something. Generally if the feature wasn't requested for decades then it probably is not needed so often.

wryun · 2025-07-21T23:02:10Z

@stokito as identified in the original issue, the behaviour of browser caching without a Cache-Control header is based on heuristics. What this means is that they don't always check the ETag, but sometimes present a cached file if they think the resource has not changed for some time.

When making JS changes this is frustrating, as it means you need to have all caching disabled and the debug tools open for reliable behaviour.

stokito reviewed Nov 19, 2024

View reviewed changes

stokito approved these changes Nov 19, 2024

View reviewed changes

main/file: add support for custom headers to file serving

1bdaac0

This allows us to set 'Cache-Control: no-cache', which makes it possible to develop LuCI JS without resorting to disabling the cache in the browser dev tools. Signed-off-by: James Haggerty <james.haggerty@morsemicro.com>

wryun force-pushed the allow-adding-additional-headers branch from 938187b to 1bdaac0 Compare November 19, 2024 23:37

vulpes2 mentioned this pull request May 8, 2025

luci-base: OUI lookup in the DHCP leases table? openwrt/luci#2065

Closed

stokito suggested changes Jul 14, 2025

View reviewed changes

main/file: add support for custom headers to file serving #13

Are you sure you want to change the base?

main/file: add support for custom headers to file serving #13

Uh oh!

Conversation

wryun commented Nov 19, 2024

Uh oh!

stokito Nov 19, 2024 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

wryun Nov 19, 2024

Choose a reason for hiding this comment

Uh oh!

stokito Nov 19, 2024 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

wryun Nov 19, 2024

Choose a reason for hiding this comment

Uh oh!

stokito Jul 14, 2025

Choose a reason for hiding this comment

Uh oh!

wryun Jul 21, 2025

Choose a reason for hiding this comment

Uh oh!

stokito left a comment

Choose a reason for hiding this comment

Uh oh!

Neustradamus commented Jul 7, 2025

Uh oh!

wryun commented Jul 14, 2025

Uh oh!

Neustradamus commented Jul 14, 2025

Uh oh!

stokito Jul 14, 2025

Choose a reason for hiding this comment

Uh oh!

wryun Jul 21, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

stokito commented Jul 14, 2025

Uh oh!

wryun commented Jul 21, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

stokito Nov 19, 2024 •

edited

Loading

stokito Nov 19, 2024 •

edited

Loading

wryun Jul 21, 2025 •

edited

Loading

wryun commented Jul 21, 2025 •

edited

Loading