Adds an error handler for the given HTTP status code

Adds an error handler for the given exception

Returns every setting to its default and empties the handler tables. Specs call this after each example; a setting #clear forgets is one that leaks from the example that set it into the next.

Returns the defined error handlers for HTTP status codes

Returns the defined error handlers for exceptions

DEPRECATED Use standard library Log

DEPRECATED Use standard library Log

Maximum number of file parts accepted in a single multipart/form-data request.

Every file part is spooled to its own temporary file, which stays open until the request is over, so the count is what bounds the file descriptors and disk entries one request can hold — #max_request_body_size does not: an 8 MB body fits some 100,000 one-byte parts. A request carrying more file parts than this is answered with 413 before the next one is written to disk; the ones already spooled are cleaned up with the request. Form fields without a filename do not count. 0 refuses file uploads altogether.

Maximum number of file parts accepted in a single multipart/form-data request.

Every file part is spooled to its own temporary file, which stays open until the request is over, so the count is what bounds the file descriptors and disk entries one request can hold — #max_request_body_size does not: an 8 MB body fits some 100,000 one-byte parts. A request carrying more file parts than this is answered with 413 before the next one is written to disk; the ones already spooled are cleaned up with the request. Form fields without a filename do not count. 0 refuses file uploads altogether.

Maximum number of byte ranges accepted in a single Range request header.

A Range header listing more parts than this is ignored and the full representation is served with 200 instead. Since send_file also refuses range sets asking for more bytes in total than the file holds, a multi-range response stays within the file's own size plus roughly 150 bytes of multipart framing per part. Raising this therefore raises the framing a single request can ask for; 0 ignores Range headers entirely and advertises Accept-Ranges: none.

Without a bound, a header such as bytes=0-,0-,0-,... makes the server re-read the whole file once per range. RFC 9110 §14.2 explicitly allows rejecting such range sets, as they indicate "either a broken client or a deliberate denial-of-service attack".

Maximum number of byte ranges accepted in a single Range request header.

A Range header listing more parts than this is ignored and the full representation is served with 200 instead. Since send_file also refuses range sets asking for more bytes in total than the file holds, a multi-range response stays within the file's own size plus roughly 150 bytes of multipart framing per part. Raising this therefore raises the framing a single request can ask for; 0 ignores Range headers entirely and advertises Accept-Ranges: none.

Without a bound, a header such as bytes=0-,0-,0-,... makes the server re-read the whole file once per range. RFC 9110 §14.2 explicitly allows rejecting such range sets, as they indicate "either a broken client or a deliberate denial-of-service attack".

Whether an unhandled exception is answered with the development error page — exception message, backtrace with source, response headers, cookies — or the static production page that says nothing about the failure.

Unset (nil, the default) means "only in the development environment". Every other environment name, including one that is misspelt or unknown, gets the production page: the development page exists to debug locally, not to serve as the fallback for a KEMAL_ENV that failed to say production. Set it to true to show the page in another environment, or to false to never show it.

How long Kemal.run waits, once the server has been stopped, for the requests that were being served at that moment to finish. Nothing in flight: it returns at once. Still something in flight when the time is up: it logs a warning and returns anyway, so a stuck handler cannot hold a deploy hostage.

A WebSocket or SSE connection counts as in flight for as long as it stays open, so an application holding such connections waits the full time on every shutdown unless it closes them itself from the Kemal.run block or a Kemal.stop caller. A second termination signal during the wait exits immediately.

How long Kemal.run waits, once the server has been stopped, for the requests that were being served at that moment to finish. Nothing in flight: it returns at once. Still something in flight when the time is up: it logs a warning and returns anyway, so a stuck handler cannot hold a deploy hostage.

A WebSocket or SSE connection counts as in flight for as long as it stays open, so an application holding such connections waits the full time on every shutdown unless it closes them itself from the Kemal.run block or a Kemal.stop caller. A second termination signal during the wait exits immediately.

WebSocket Origin policy for upgrade requests.

• Empty (default): same-origin — Origin must match the request Host (scheme is taken from Origin, so TLS termination in front of Kemal still works). Missing or empty Origin is rejected with 403.
• Non-empty allowlist: Origin must match one of the entries after normalization (scheme/host/port only). Missing Origin is rejected.
• Include "*" to allow any origin, including requests without Origin (previous allow-all behavior).
• Use "null" to allow the browser's opaque "null" origin.

Entries use the serialized origin form, e.g. "https://example.com" or "http://localhost:3000".

WebSocket Origin policy for upgrade requests.

• Empty (default): same-origin — Origin must match the request Host (scheme is taken from Origin, so TLS termination in front of Kemal still works). Missing or empty Origin is rejected with 403.
• Non-empty allowlist: Origin must match one of the entries after normalization (scheme/host/port only). Missing Origin is rejected.
• Include "*" to allow any origin, including requests without Origin (previous allow-all behavior).
• Use "null" to allow the browser's opaque "null" origin.

Entries use the serialized origin form, e.g. "https://example.com" or "http://localhost:3000".