/ 
PAGI-0.001019

Changes for version 0.001019 - 2026-02-19

  • New Features
    • Router: rewrite _compile_path() as tokenizer with proper regex escaping, so literal path segments containing regex metacharacters (e.g., /foo.bar) are matched literally instead of as patterns
    • Router: inline constraint syntax {name:pattern} for path parameters (e.g., /user/{id:\d+}) validated during dispatch
    • Router: chainable constraints() method for applying regex constraints to named path parameters after route definition
    • Router: any() multi-method matcher supporting wildcard ('*') and explicit method lists (e.g., any [qw(GET POST)] => '/path' => $handler)
    • Router: named routes and uri_for() now support {name:pattern} syntax and any() routes
    • Router: group() for organizing routes under a common prefix, with three forms: callback (sub), router-object, and string (auto-require). Supports middleware, nesting, named route namespacing via as(), and conflict detection
    • Router: mount() now accepts a string class name with auto-require and to_app dispatch
    • SSE over HTTP/2 with streaming DATA frames, keepalive comments, and disconnect handling
    • Add PAGI::Utils::Random module for cryptographically secure random bytes
    • Rate limiter: periodic cleanup and safety valve for expired buckets
    • CORS middleware: warn when configured with wildcard origins and credentials
  • Security Fixes
    • Fix XSS in Debug middleware panel by escaping scope values in HTML output
    • Add max_chunk_size limit (default 1MB) to HTTP/1.1 chunked transfer parser to prevent denial-of-service via unbounded chunk sizes
    • Use cryptographically secure random bytes (via /dev/urandom with Crypt::URandom fallback) in RequestId, CSRF, and Session middleware instead of rand()
    • Default session cookie SameSite=Lax to prevent CSRF via cross-site requests
    • Fix double URL-decoding in Static middleware that could allow path traversal
  • Bug Fixes
    • Fix HTTP/2 path decoding to match HTTP/1.1 decoding pipeline
    • Fix HTTP/2 WebSocket path decoding to match HTTP/1.1 pipeline
    • Require Net::HTTP2::nghttp2 0.007+ for HTTP/2 support (was unversioned)
  • Improvements
    • Extract _format_sse_event() and _format_sse_comment() helpers and protocol-abstracted keepalive writer for consistent SSE formatting across HTTP/1.1 and HTTP/2

Documentation

pagi-server
PAGI application server
PAGI::Cookbook
Recipes for Common PAGI Tasks
PAGI::Server::Compliance
HTTP/1.1, HTTP/2, WebSocket, and Security Compliance Documentation
PAGI::Spec
PAGI Specification Documentation
PAGI::Spec::Lifespan
PAGI Specification Documentation
PAGI::Spec::Tls
PAGI Specification Documentation
PAGI::Spec::Www
PAGI Specification Documentation
PAGI::Tutorial
A comprehensive guide to building async web applications with PAGI

Modules

PAGI
Perl Asynchronous Gateway Interface
PAGI::App::Cascade
Try apps in sequence until success
PAGI::App::Directory
Serve files with directory listing
PAGI::App::File
Serve static files
PAGI::App::Healthcheck
Health check endpoint app
PAGI::App::Loader
Load PAGI app from file
PAGI::App::NotFound
Customizable 404 response
PAGI::App::Proxy
HTTP reverse proxy (DEMO ONLY - NOT FOR PRODUCTION)
PAGI::App::Redirect
URL redirect app
PAGI::App::Router
Unified routing for HTTP, WebSocket, and SSE
PAGI::App::SSE::Pubsub
Pub/sub Server-Sent Events
PAGI::App::Throttle
Rate-limited request processing
PAGI::App::URLMap
Mount apps at URL path prefixes
PAGI::App::WebSocket::Broadcast
Pub/sub WebSocket broadcast
PAGI::App::WebSocket::Chat
Multi-room chat application
PAGI::App::WebSocket::Echo
Echo WebSocket messages back to sender
PAGI::App::WrapCGI
Execute CGI scripts as PAGI apps
PAGI::App::WrapPSGI
PSGI-to-PAGI adapter
PAGI::Endpoint::HTTP
Class-based HTTP endpoint handler
PAGI::Endpoint::Router
Class-based router with wrapped handlers
PAGI::Endpoint::SSE
Class-based Server-Sent Events endpoint handler
PAGI::Endpoint::WebSocket
Class-based WebSocket endpoint handler
PAGI::Lifespan
Wrap a PAGI app with lifecycle management
PAGI::Middleware
Base class for PAGI middleware
PAGI::Middleware::AccessLog
Request logging middleware
PAGI::Middleware::Auth::Basic
HTTP Basic Authentication middleware
PAGI::Middleware::Auth::Bearer
Bearer token authentication middleware
PAGI::Middleware::Builder
DSL for composing PAGI middleware
PAGI::Middleware::CORS
Cross-Origin Resource Sharing middleware
PAGI::Middleware::CSRF
Cross-Site Request Forgery protection middleware
PAGI::Middleware::ConditionalGet
Conditional GET/HEAD request handling
PAGI::Middleware::ContentLength
Auto Content-Length header middleware
PAGI::Middleware::ContentNegotiation
HTTP content negotiation middleware
PAGI::Middleware::Cookie
Cookie parsing middleware
PAGI::Middleware::Debug
Development debug panel middleware
PAGI::Middleware::ETag
ETag generation middleware
PAGI::Middleware::ErrorHandler
Exception handling middleware
PAGI::Middleware::FormBody
Form request body parsing middleware
PAGI::Middleware::GZip
Response compression middleware
PAGI::Middleware::HTTPSRedirect
Force HTTPS redirect middleware
PAGI::Middleware::Head
HEAD request handling middleware
PAGI::Middleware::Healthcheck
Health check endpoint middleware
PAGI::Middleware::JSONBody
JSON request body parsing middleware
PAGI::Middleware::Lint
Validate PAGI application compliance
PAGI::Middleware::Maintenance
Serve maintenance page when enabled
PAGI::Middleware::MethodOverride
Override HTTP method from request data
PAGI::Middleware::RateLimit
Request rate limiting middleware
PAGI::Middleware::RequestId
Unique request ID middleware
PAGI::Middleware::ReverseProxy
Handle X-Forwarded-* headers from reverse proxies
PAGI::Middleware::Rewrite
URL rewriting middleware
PAGI::Middleware::Runtime
Request timing middleware
PAGI::Middleware::SSE::Retry
Add retry hints to SSE events
PAGI::Middleware::SecurityHeaders
Security headers middleware
PAGI::Middleware::Session
Session management middleware
PAGI::Middleware::Static
Static file serving middleware
PAGI::Middleware::TrustedHosts
Host header validation middleware
PAGI::Middleware::WebSocket::Compression
WebSocket per-message compression
PAGI::Middleware::WebSocket::RateLimit
Rate limiting for WebSocket connections
PAGI::Middleware::XSendfile
Delegate file serving to reverse proxy
PAGI::Request
Convenience wrapper for PAGI request scope
PAGI::Request::BodyStream
Streaming body consumption for PAGI requests
PAGI::Request::MultiPartHandler
Async multipart/form-data parser
PAGI::Request::Negotiate
Content negotiation utilities for PAGI
PAGI::Request::Upload
Uploaded file representation
PAGI::Response
Fluent response builder for PAGI applications
PAGI::Runner
PAGI application loader and server runner
PAGI::SSE
Convenience wrapper for PAGI Server-Sent Events connections
PAGI::Server
PAGI Reference Server Implementation
PAGI::Server::AsyncFile
Non-blocking file I/O for PAGI::Server internals
PAGI::Server::Connection
Per-connection state machine
PAGI::Server::ConnectionState
Connection state tracking for HTTP requests
PAGI::Server::EventValidator
Dev-mode event field validation
PAGI::Server::Protocol::HTTP1
HTTP/1.1 protocol handler
PAGI::Server::Protocol::HTTP2
HTTP/2 protocol handler using nghttp2
PAGI::Test::Client
Test client for PAGI applications
PAGI::Test::Response
HTTP response wrapper for testing
PAGI::Test::SSE
Server-Sent Events connection for testing PAGI applications
PAGI::Test::WebSocket
WebSocket connection for testing PAGI applications
PAGI::Utils
Shared utility helpers for PAGI
PAGI::Utils::Random
Cryptographically secure random bytes
PAGI::WebSocket
Convenience wrapper for PAGI WebSocket connections

Provides

PAGI::App::WrapPSGI::Writer
in lib/PAGI/App/WrapPSGI.pm
PAGI::Endpoint::Router::RouteBuilder
in lib/PAGI/Endpoint/Router.pm
PAGI::Middleware::Cookie::Jar
in lib/PAGI/Middleware/Cookie.pm
PAGI::Response::Writer
in lib/PAGI/Response.pm
PAGI::Server::Protocol::HTTP2::Session
in lib/PAGI/Server/Protocol/HTTP2.pm

Examples

Other files