Public endpoints · Frontend

Every state-changing request the server proxies with the session must carry an Origin that matches the frontend's own, and goes out with the signed-in user's session. A route meant for callers outside the dashboard, such as a mail provider's delivery webhook or a payment provider's callback, fails both ways: the caller sends no Origin, and its secret header is not among the few the proxy relays.

A backend module declares such a route public when it registers its frontend:

src/index.ts

await AddFrontendModule({
  name: "@antelopejs/dms-mailing-frontend-vue",
  sourcePath: path.join(__dirname, "../frontend-vue"),
  renderer: { name: "vue", version: "3" },
  publicEndpoints: [
    {
      path: "/api/mailing/events/*/*",
      methods: ["POST"],
      headers: ["x-mailing-webhook-secret"],
    },
  ],
});

A request to a public endpoint:

needs no Origin;
is never sent the session, even from a signed-in browser, so a cross-site form posting to it acts as nobody. The route authenticates its caller itself, with a shared secret or a signature;
carries the module's declared headers on top of the usual ones.

Declaration rules

path is an absolute /api/ path whose first segment is literal (the module's own prefix, never *) and whose later * segments match exactly one segment. Nothing else matches: no prefix, no query string, no . or .. segment.
methods defaults to ["POST"].
headers names the module's own x- headers. The ones a proxy or the DMS gives a meaning to (x-forwarded-*, x-real-ip, x-dms-*, x-inertia*, method overrides) are refused, as are authorization and cookie.
A malformed declaration is dropped whole, with a warning, never widened.

The proxy matches the request's normalized path, the one it sends the backend, so .., %2e%2e or \ cannot reach another route through a public one. A module route that answers a public endpoint's path is reported when the server starts.

DMS_PUBLIC_ENDPOINTS adds entries of the same shape, as a JSON array, for a route no module declares:

.env

DMS_PUBLIC_ENDPOINTS=[{"path":"/api/acme/hooks/*","methods":["POST"],"headers":["x-acme-signature"]}]