Routing and the backend proxy

The frontend server answers each path with one owner, whoever asks and whatever the method. It looks for the owner in this order.

Who answers a path

The server lists the result when it starts:

Routing: renderer files, then 21 module routes, then the backend proxies below, then the pages
  /api/**    -> backend (session), declared by antelopejs__dms-frontend-vue
  /dms/**    -> backend (session), declared by antelopejs__dms-frontend-vue
  /ai/**     -> backend (session), declared by @antelopejs/dms-ai-frontend-vue
  /i18n/**   -> backend (none), declared by @antelopejs/dms-lang-frontend-vue
  /media/**  -> backend (session), declared by @antelopejs/dms-media-frontend-vue

In development, every answer names its owner in an x-dms-route-owner header: renderer, module:<id>, backend:<pattern>, page or not-found.

Declaring a backend prefix

server.registerBackendProxy("/api/**"); // auth: "session", the default
server.registerBackendProxy("/media/**", { auth: "none" });

await AddFrontendModule({
  // …
  backendProxies: [{ path: "/webhooks/acme/**", auth: "none" }],
});

DMS_BACKEND_PROXIES=[{"path":"/webhooks/acme/**","auth":"none"}]

• auth: "session" adds the session's access token to the request (Authorization: Bearer), server-side: the token never reaches the browser, which only holds the sealed, HttpOnly session cookie. A request with a state-changing method must carry the frontend's own Origin, except on a public endpoint.
• auth: "none" never sends the session, so it needs no Origin: for media, or a webhook that authenticates its caller itself.

A pattern is /x, /x/* (one segment below) or /x/** (the path and everything below), its first segment literal, outside the renderer's own paths. Of two patterns covering a path, the more specific wins. For one pattern, the highest-priority frontend module's declaration wins, then the manifest's, with a warning.

What the proxy sends

Every proxied request relays:

• If-Match, so a backend route can refuse a write made from a stale copy (412 or 409);
• the client's Origin and Referer as received, so a public route can check where a beacon comes from;
• X-Forwarded-For, X-Forwarded-Proto and X-Forwarded-Host, set by the proxy itself so a route can limit each client. The client's own X-Forwarded-For is extended with the socket's address only behind DMS_TRUSTED_PROXY_HOPS trusted proxies, and replaced by it otherwise.

The proxy matches the request's normalized path, the one it sends the backend, so .., %2e%2e or \ cannot reach another route through a declared prefix.

Response compression

The proxy asks the backend for an uncompressed answer. It compresses eligible text (JSON, text, XML and SVG) of at least 1 KiB, or of unknown length, using Brotli or gzip according to the client's Accept-Encoding qualities. Streaming compression delivers each part as the backend writes it. Eligible answers include Vary: Accept-Encoding even when the client receives identity bytes.

The proxy does not compress event streams, ranges, answers marked no-transform, or opaque encoded bodies. If the backend ignores the identity request, native fetch decodes supported encodings; the proxy removes the stale encoding and length before relaying or recompressing that body. A decoded encoded range returns 502 rather than forwarding byte offsets that no longer describe its body. HEAD and bodyless responses retain their representation metadata.