Docs

Introduction

What is rune

Philosophy

Why rune

Architecture

Getting Started

Installation

Quick start

Project structure

The dev loop

Tutorial: build an app

1. Create the app

2. Pages & routes

3. Layouts

4. State with Mimir

5. SSR & data

6. API routes

7. Styling

8. Build & deploy

Core Concepts

The application object

Rendering pipeline

Hydration

The build manifest

Configuration (ekko.json)

Permissions

Conventions

Routing

File-based routing

Dynamic routes

The router (useRouter)

Navigation & Link

Guards & redirects

Programmatic routes

Server-Side Rendering

Overview

The ssr() function

Strategies (eager/lazy)

SSR → hydration

Caching & invalidation

SEO

Mimir, state management

Overview

Atoms

Reading & writing

Selectors (derived state)

Subscriptions & the store

SSR & hydration

Persistence & sessions

Patterns & recipes

Pitfalls

Pages & Layouts

Pages

Layouts

Error & not-found

API Routes

Defining routes

Request & response

Middleware

helmet

cors

rateLimit

bodyLimit

validateContentType

csrf

requestId

timeout

errorHandler

httpsRedirect

secureCookies

ipFilter

safePath

Validation & options

Styling & Theming

SCSS

Theming (light/dark)

Asgard integration

No flash (no-FOUC)

Building & Deploying

The build

Static assets

Production deploy

API Reference

ekko:rune

ekko:rune/router

ekko:rune/mimir

ekko:rune/seo

ekko:ssr / css

ekko.json schema

CLI commands

Guides

Rune app from scratch

Recipes

Dark mode

Forms

Data fetching

Authentication

Pagination

FAQ (use cases)

`secureCookies()`

Make every cookie your app sets Secure (HTTPS-only) by default, alongside HttpOnly and SameSite.

secureCookies request flow

Use case

A single cookie set without the Secure flag can be sent over plain HTTP and captured on the network. Rather than remembering the flag on every res.cookie call, this middleware makes secure the default, so a stray cookie cannot leak.

How it works

It overrides res.cookie so each cookie gets Secure unless you explicitly opt out, plus HttpOnly (not readable by JavaScript) and SameSite=Lax (not sent on cross-site navigations). Then it calls next(). Your handlers keep calling res.cookie exactly as before; the flags are added for you.

Configuration

No options. Register it in production so every cookie is hardened by default.

Example

00000000001
2
3
4
5
6
import { secureCookies } from "ekko:web";
 
app.use(secureCookies());
 
// then in a handler, no per-cookie flags needed:
res.cookie("session", token, { maxAge: 86400 });  // -> HttpOnly; Secure; SameSite=Lax

Notes

In local development over plain HTTP a Secure cookie will not be stored by the browser. Gate this middleware on production (or skip it in dev) so your local session cookies still work, while production always gets the hardened defaults.

Next: ipFilter.

On this page

Use case How it works Configuration Example Notes