Docs

Introduction

What is rune

Philosophy

Why rune

Architecture

Getting Started

Installation

Quick start

Project structure

The dev loop

Tutorial: build an app

1. Create the app

2. Pages & routes

3. Layouts

4. State with Mimir

5. SSR & data

6. API routes

7. Styling

8. Build & deploy

Core Concepts

The application object

Rendering pipeline

Hydration

The build manifest

Configuration (ekko.json)

Permissions

Conventions

Routing

File-based routing

Dynamic routes

The router (useRouter)

Navigation & Link

Guards & redirects

Programmatic routes

Server-Side Rendering

Overview

The ssr() function

Strategies (eager/lazy)

SSR → hydration

Caching & invalidation

SEO

Mimir, state management

Overview

Atoms

Reading & writing

Selectors (derived state)

Subscriptions & the store

SSR & hydration

Persistence & sessions

Patterns & recipes

Pitfalls

Pages & Layouts

Pages

Layouts

Error & not-found

API Routes

Defining routes

Request & response

Middleware

helmet

cors

rateLimit

bodyLimit

validateContentType

csrf

requestId

timeout

errorHandler

httpsRedirect

secureCookies

ipFilter

safePath

Validation & options

Styling & Theming

SCSS

Theming (light/dark)

Asgard integration

No flash (no-FOUC)

Building & Deploying

The build

Static assets

Production deploy

API Reference

ekko:rune

ekko:rune/router

ekko:rune/mimir

ekko:rune/seo

ekko:ssr / css

ekko.json schema

CLI commands

Guides

Rune app from scratch

Recipes

Dark mode

Forms

Data fetching

Authentication

Pagination

FAQ (use cases)

`httpsRedirect()`

Send any plaintext request to its HTTPS URL with a 301, working behind a TLS-terminating proxy.

Use case

A site served over plain HTTP exposes cookies and content to anyone on the network. Redirecting every HTTP request to HTTPS makes the secure URL the only one that works, and combined with HSTS (from helmet), repeat visitors skip HTTP entirely.

How it works

It checks whether the request is already secure, using req.protocol and the X-Forwarded-Proto header set by a TLS-terminating proxy (nginx, a load balancer). If it is HTTP, it replies 301 Moved Permanently to the https:// URL of the same host and path; if already HTTPS, it calls next().

Configuration

Option	Default	Notes
`httpsPort`	`443`	Port in the redirect URL (omitted when `443`).

Example

00000000001
2
3
4
import { httpsRedirect } from "ekko:web";
 
app.use(httpsRedirect());                  // -> https://<host><path>
app.use(httpsRedirect({ httpsPort: 8443 }));

Notes

Behind nginx (the recommended setup), you usually let nginx do the 80 -> 443 redirect (certbot's --redirect adds it). Use this middleware when the rune app terminates TLS itself, or as belt-and-braces. It relies on X-Forwarded-Proto, which your proxy must set, or every request looks like plain HTTP.

Next: secureCookies.

On this page

Use case How it works Configuration Example Notes