Expand description
GET /ui/static/{file} — the two vendored assets, out of the binary.
Embedded rather than served from disk: a deployment stays one executable,
and tower-http’s fs feature — with the path-traversal surface that comes
with it — stays off. The match below is the entire allowlist, so there is no
traversal to defend against in the first place.
Outside the session requirement. The sign-in page needs the stylesheet
before anyone has a session, and neither file says anything about this
deployment: htmx.min.js is a public release (see static/README.md for
its provenance) and admin.css is a stylesheet.
Functions§
- get_
asset GET /ui/static/{file}.