Docs

Introduction

What is rune

Philosophy

Why rune

Architecture

Getting Started

Installation

Quick start

Project structure

The dev loop

Tutorial: build an app

1. Create the app

2. Pages & routes

3. Layouts

4. State with Mimir

5. SSR & data

6. API routes

7. Styling

8. Build & deploy

Core Concepts

The application object

Rendering pipeline

Hydration

The build manifest

Configuration (ekko.json)

Permissions

Conventions

Routing

File-based routing

Dynamic routes

The router (useRouter)

Navigation & Link

Guards & redirects

Programmatic routes

Server-Side Rendering

Overview

The ssr() function

Strategies (eager/lazy)

SSR → hydration

Caching & invalidation

SEO

Mimir, state management

Overview

Atoms

Reading & writing

Selectors (derived state)

Subscriptions & the store

SSR & hydration

Persistence & sessions

Patterns & recipes

Pitfalls

Pages & Layouts

Pages

Layouts

Error & not-found

API Routes

Defining routes

Request & response

Middleware

helmet

cors

rateLimit

bodyLimit

validateContentType

csrf

requestId

timeout

errorHandler

httpsRedirect

secureCookies

ipFilter

safePath

Validation & options

Styling & Theming

SCSS

Theming (light/dark)

Asgard integration

No flash (no-FOUC)

Building & Deploying

The build

Static assets

Production deploy

API Reference

ekko:rune

ekko:rune/router

ekko:rune/mimir

ekko:rune/seo

ekko:ssr / css

ekko.json schema

CLI commands

Guides

Rune app from scratch

Recipes

Dark mode

Forms

Data fetching

Authentication

Pagination

FAQ (use cases)

`validateContentType()`

Reject requests whose body is not a content type you accept, with 415 Unsupported Media Type.

validateContentType request flow

Use case

A handler that expects JSON should not have to defend against a form-encoded or text/html body. Enforcing the content type up front defends against type-confusion bugs and sloppy clients, and keeps your parsing code honest: by the time the handler runs, the body is a type it knows.

How it works

It applies to body methods (POST, PUT, PATCH) and compares the request's Content-Type (ignoring parameters like ; charset=utf-8) against the allowed types list, by exact match. A mismatch, or a missing content type when allowEmpty is off, replies 415 Unsupported Media Type. GET/HEAD/DELETE pass through untouched.

Configuration

Option	Default	Notes
`types`	`application/json, text/plain, application/x-www-form-urlencoded, multipart/form-data`	Allowed media types (exact match, params ignored).
`allowEmpty`	`false`	Allow a body method with no content type. Off by default, an empty type is rejected.

Example

00000000001
2
3
4
import { validateContentType } from "ekko:web";
 
app.use(validateContentType());                              // accept the common defaults
app.use(validateContentType({ types: ["application/json"] })); // JSON-only API

Notes

Narrow types to exactly what your API accepts. A JSON API that only ever lists application/json will reject a stray multipart/form-data probe with a clean 415 instead of failing deeper in a parser.

Next: csrf.

On this page

Use case How it works Configuration Example Notes