A generic handler monad, which can have a different subsite and master site. We define a newtype for better error message.

Get the master site application argument.

Get a specific component of the master site application argument. Analogous to the gets function for operating on StateT.

Get the URL rendering function.

The URL rendering function with query-string parameters.

Get all the post parameters passed to the handler. To also get the submitted files (if any), you have to use runRequestBody instead of this function.

Since: 1.4.33

Get the route requested by the user. If this is a 404 response- where the user requested an invalid route- this function will return Nothing.

Get the request's Request value.

Stream in the raw request body without any parsing.

Since: 1.2.0

A tuple containing both the POST parameters and submitted files.

The parsed request information. This type augments the standard WAI Request with additional information.

Stream the data from the file. Since Yesod 1.2, this has been generalized to work in any MonadResource.

Extract a strict ByteString body from a FileInfo.

This function will block while reading the file.

do
    fileByteString <- fileSourceByteString fileInfo

Since: 1.6.5

Get the list of supported languages supplied by the user.

Languages are determined based on the following (in descending order of preference):

• The _LANG get parameter.
• The _LANG user session variable.
• The _LANG cookie.
• Accept-Language HTTP header.

Yesod will seek the first language from the returned list matched with languages supporting by your application. This language will be used to render i18n templates. If a matching language is not found the default language will be used.

This is handled by parseWaiRequest (not exposed).

NOTE: Before version 1.6.19.0, this function prioritized the session variable above all other sources.

Lookup for GET parameters.

Lookup for cookie data.

Lookup for POSTed files.

Lookup a request header.

Since: 1.2.2

Lookup basic authentication data from Authorization header of request. Returns user name and password

Since: 1.4.9

Lookup bearer authentication datafrom Authorization header of request. Returns bearer token value

Since: 1.4.9

Lookup for GET parameters.

Lookup for POST parameters.

Lookup for cookie data.

Lookup for POSTed files.

Lookup a request header.

Since: 1.2.2

Provide a pure value for the response body.

respond ct = return . TypedContent ct . toContent

Since: 1.2.0

Use a Source for the response body.

Note that, for ease of use, the underlying monad is a HandlerFor. This implies that you can run any HandlerFor action. However, since a streaming response occurs after the response headers have already been sent, some actions make no sense here. For example: short-circuit responses, setting headers, changing status codes, etc.

Since: 1.2.0

In a streaming response, send a single chunk of data. This function works on most datatypes, such as ByteString and Html.

Since: 1.2.0

In a streaming response, send a flush command, causing all buffered data to be immediately sent to the client.

Since: 1.2.0

Type-specialized version of sendChunk for strict ByteStrings.

Since: 1.2.0

Type-specialized version of sendChunk for lazy ByteStrings.

Since: 1.2.0

Type-specialized version of sendChunk for strict Texts.

Since: 1.2.0

Type-specialized version of sendChunk for lazy Texts.

Since: 1.2.0

Type-specialized version of sendChunk for Htmls.

Since: 1.2.0

Some value which can be turned into a URL for redirects.

Redirect to the given route. HTTP status code 303 for HTTP 1.1 clients and 302 for HTTP 1.0 This is the appropriate choice for a get-following-post technique, which should be the usual use case.

If you want direct control of the final status code, or need a different status code, please use redirectWith.

Redirect to the given URL with the specified status code.

Redirect to a POST resource.

This is not technically a redirect; instead, it returns an HTML page with a POST form, and some Javascript to automatically submit the form. This can be useful when you need to post a plain link somewhere that needs to cause changes on the server.

Add a fragment identifier to a route to be used when redirecting. For example:

redirect (NewsfeedR :#: storyId)

@since 1.2.9.

Return a 404 not found page. Also denotes no handler available.

Return a 405 method not supported page.

Return a 401 status code

Return a 403 permission denied page.

Return a 403 permission denied page.

Return a 400 invalid arguments page.

Return a 400 invalid arguments page.

Bypass remaining handler code and output the given file.

For some backends, this is more efficient than reading in the file to memory, since they can optimize file sending via a system call to sendfile.

Same as sendFile, but only sends part of a file.

Bypass remaining handler code and output the given content with a 200 status code.

Bypass remaining handler code and output the given content with the given status code.

Bypass remaining handler code and output the given JSON with the given status code.

Since: 1.4.18

Send a 201 Created response with the given route as the Location response header.

Bypass remaining handler code and output no content with a 204 status code.

Since: 1.6.9

Send a Response. Please note: this function is rarely necessary, and will disregard any changes to response headers and session that you have already specified. This function short-circuits. It should be considered only for very specific needs. If you are not sure if you need it, you don't.

Switch over to handling the current request with a WAI Application.

Since: 1.2.17

Send a raw response. This is used for cases such as WebSockets. Requires WAI 2.1 or later, and a web server which supports raw responses (e.g., Warp).

Since: 1.2.7

Send a raw response without conduit. This is used for cases such as WebSockets. Requires WAI 3.0 or later, and a web server which supports raw responses (e.g., Warp).

Since: 1.2.16

Send a 304 not modified response immediately. This is a short-circuiting action.

Since: 1.4.4

Select a representation to send to the client based on the representations provided inside this do-block. Should be used together with provideRep.

Since: 1.2.0

Provide a single representation to be used, based on the request of the client. Should be used together with selectRep.

Since: 1.2.0

Same as provideRep, but instead of determining the content type from the type of the value itself, you provide the content type separately. This can be a convenience instead of creating newtype wrappers for uncommonly used content types.

provideRepType "application/x-special-format" "This is the content"

Since: 1.2.0

Internal representation of a single provided representation.

Since: 1.2.0

Set the cookie on the client.

Helper function for setCookieExpires value

Unset the cookie on the client.

Note: although the value used for key and path is Text, you should only use ASCII values to be HTTP compliant.

Set an arbitrary response header.

Note that, while the data type used here is Text, you must provide only ASCII value to be HTTP compliant.

Since: 1.2.0

Deprecated synonym for addHeader.

Replace an existing header with a new value or add a new header if not present.

Note that, while the data type used here is Text, you must provide only ASCII value to be HTTP compliant.

Since: 1.4.36

Set the language in the user session. Will show up in languages on the next request.

Set attachment file name.

Allows Unicode characters by encoding to UTF-8. Some modurn browser parse UTF-8 characters with out encoding setting. But, for example IE9 can't parse UTF-8 characters. This function use RFC 6266(RFC 5987)

Since: 1.6.4

Set the Cache-Control header to indicate this response should be cached for the given number of seconds.

Set the Expires header to some date in 2037. In other words, this content is never (realistically) expired.

Set an Expires header in the past, meaning this content should not be cached.

Set an Expires header to the given date.

Check the if-none-match header and, if it matches the given value, return a 304 not modified response. Otherwise, set the etag header to the given value.

Note that it is the responsibility of the caller to ensure that the provided value is a valid etag value, no sanity checking is performed by this function.

Since: 1.4.4

Check the if-none-match header and, if it matches the given value, return a 304 not modified response. Otherwise, set the etag header to the given value.

A weak etag is only expected to be semantically identical to the prior content, but doesn't have to be byte-for-byte identical. Therefore it can be useful for dynamically generated content that may be difficult to perform bytewise hashing upon.

Note that it is the responsibility of the caller to ensure that the provided value is a valid etag value, no sanity checking is performed by this function.

Since: 1.4.37

Lookup for session data.

Lookup for session data in binary format.

Get all session variables.

Set a variable in the user's session.

The session is handled by the clientsession package: it sets an encrypted and hashed cookie on the client. This ensures that all data is secure and not tampered with.

Same as setSession, but uses binary data for the value.

Unsets a session variable. See setSession.

Clear all session variables.

@since: 1.0.1

Sets the ultimate destination variable to the given route.

An ultimate destination is stored in the user session and can be loaded later by redirectUltDest.

Same as setUltDest, but uses the current page.

If this is a 404 handler, there is no current page, and then this call does nothing.

Sets the ultimate destination to the referer request header, if present.

This function will not overwrite an existing ultdest.

Redirect to the ultimate destination in the user's session. Clear the value from the session.

The ultimate destination is set with setUltDest.

This function uses redirect, and thus will perform a temporary redirect to a GET request.

Remove a previously set ultimate destination. See setUltDest.

Adds a status and message in the user's session.

See getMessages.

Since: 1.4.20

Adds a message in the user's session but uses RenderMessage to allow for i18n

See getMessages.

Since: 1.4.20

Gets all messages in the user's session, and then clears the variable.

See addMessage.

Since: 1.4.20

Calls addMessage with an empty status

Calls addMessageI with an empty status

Gets just the last message in the user's session, discards the rest and the status

A handler monad for subsite

Since: 1.6.0

Wraps the Content generated by hamletToContent in a RepHtml.

Deprecated synonym for withUrlRenderer.

Since: 1.2.0

Provide a URL rendering function to the given function and return the result. Useful for processing Shakespearean templates.

Since: 1.2.20

Get a unique identifier.

Returns a function that runs HandlerFor actions inside IO.

Sometimes you want to run an inner HandlerFor action outside the control flow of an HTTP request (on the outer HandlerFor action). For example, you may want to spawn a new thread:

getFooR :: Handler RepHtml
getFooR = do
  runInnerHandler <- handlerToIO
  liftIO $ forkIO $ runInnerHandler $ do
    Code here runs inside HandlerFor but on a new thread.
    This is the inner HandlerFor.
    ...
  Code here runs inside the request's control flow.
  This is the outer HandlerFor.
  ...

Another use case for this function is creating a stream of server-sent events using HandlerFor actions (see yesod-eventsource).

Most of the environment from the outer HandlerFor is preserved on the inner HandlerFor, however:

• The request body is cleared (otherwise it would be very difficult to prevent huge memory leaks).
• The cache is cleared (see cached).

Changes to the response made inside the inner HandlerFor are ignored (e.g., session variables, cookies, response headers). This allows the inner HandlerFor to outlive the outer HandlerFor (e.g., on the forkIO example above, a response may be sent to the client without killing the new thread).

forkIO for a Handler (run an action in the background)

Uses handlerToIO, liftResourceT, and resourceForkIO for correctness and efficiency

Since: 1.2.8

Use a per-request cache to avoid performing the same action multiple times. Values are stored by their type, the result of typeOf from Typeable. Therefore, you should use different newtype wrappers at each cache site.

For example, yesod-auth uses an un-exported newtype, CachedMaybeAuth and exports functions that utilize it such as maybeAuth. This means that another module can create its own newtype wrapper to cache the same type from a different action without any cache conflicts.

See the original announcement: http://www.yesodweb.com/blog/2013/03/yesod-1-2-cleaner-internals

Since: 1.2.0

Retrieves a value from the cache used by cached.

Since: 1.6.10

Sets a value in the cache used by cached.

Since: 1.6.10

a per-request cache. just like cached. cached can only cache a single value per type. cachedBy stores multiple values per type by usage of a ByteString key

cached is ideal to cache an action that has only one value of a type, such as the session's current user cachedBy is required if the action has parameters and can return multiple values per type. You can turn those parameters into a ByteString cache key. For example, caching a lookup of a Link by a token where multiple token lookups might be performed.

Since: 1.4.0

Retrieves a value from the cache used by cachedBy.

Since: 1.6.10

Sets a value in the cache used by cachedBy.

Since: 1.6.10

Sets a cookie with a CSRF token, using defaultCsrfCookieName for the cookie name.

The cookie's path is set to /, making it valid for your whole website.

Since: 1.4.14

Takes a SetCookie and overrides its value with a CSRF token, then sets the cookie.

Make sure to set the setCookiePath to the root path of your application, otherwise you'll generate a new CSRF token for every path of your app. If your app is run from from e.g. www.example.com/app1, use app1. The vast majority of sites will just use /.

Since: 1.4.14

The default cookie name for the CSRF token ("XSRF-TOKEN").

Since: 1.4.14

Takes a header name to lookup a CSRF token. If the value doesn't match the token stored in the session, this function throws a PermissionDenied error.

Since: 1.4.14

Takes a header name to lookup a CSRF token, and returns whether the value matches the token stored in the session.

Since: 1.4.14

The default header name for the CSRF token ("X-XSRF-TOKEN").

Since: 1.4.14

Takes a POST parameter name to lookup a CSRF token, and returns whether the value matches the token stored in the session.

Since: 1.4.14

Takes a POST parameter name to lookup a CSRF token. If the value doesn't match the token stored in the session, this function throws a PermissionDenied error.

Since: 1.4.14

The default parameter name for the CSRF token ("_token")

Since: 1.4.14

Checks that a valid CSRF token is present in either the request headers or POST parameters. If the value doesn't match the token stored in the session, this function throws a PermissionDenied error.

Since: 1.4.14