Sleipnir v1.0.7

Sleipnir changelog: 1.0.4 to 1.0.7

Changes since 1.0.3: conditional requests, range requests for media, streaming for Server-Sent Events and similar responses, more .htaccess directives, and two correctness fixes.

1.0.4: Conditional requests (304)

Static responses now include a strong ETag and a Last-Modified header. Sleipnir checks If-None-Match and If-Modified-Since and replies 304 Not Modified when the client's cached copy is still current.

Browsers and CDNs can revalidate an unchanged file without downloading it again, which speeds up repeat visits and saves bandwidth. This is on by default and needs no config.

1.0.5: Range requests (media streaming)

Sleipnir now sends Accept-Ranges: bytes and answers Range requests with 206 Partial Content. It also handles If-Range and returns 416 for unsatisfiable ranges.

Seeking in video now works properly, and interrupted downloads can be resumed. Players request only the part of the file they need instead of the whole thing.

1.0.6: More .htaccess support

• ErrorDocument sets custom error pages per site. The path is resolved the same way as a RewriteRule target, so ../ can point to files above the document root. It overrides the global error page and works for any status code, including 401.
• DirectoryIndex is now supported. If it isn't set, Sleipnir falls back to the built-in index.php and index.html.
• RewriteRule [F] and [G] now work. [F] returns 403 Forbidden and [G] returns 410 Gone, so common hardening rules behave as expected.

1.0.7: Streaming responses and a header fix

• Streaming responses. Sleipnir now recognises streaming responses and passes them through as they arrive, using Transfer-Encoding: chunked. Before, it buffered the whole body first. A response counts as streaming if it has Content-Type: text/event-stream, X-Accel-Buffering: no, application/x-ndjson or multipart/x-mixed-replace, or if the upstream response is chunked. This means Server-Sent Events, live logs and apps that output text a piece at a time now reach the client as the data is generated, instead of all at once when the response finishes. All other responses still use the buffered path.
• Long response headers are no longer cut off. Header values used to be limited to 255 bytes. A long Content-Security-Policy, Permissions-Policy or Link header could be cut partway through a directive and sent out invalid, with no warning. Values are now passed through in full. The new limit is much higher, and a header over it is logged and dropped instead of being truncated. Streamed responses are never compressed, and Cache-Control: no-transform is respected.