# `Slap.Streams.HTTP.Router`
[🔗](https://github.com/mjrusso/slap/blob/slap_streams-v0.3.0/slap_streams/lib/slap/streams/http/router.ex#L1)

The [Durable Streams protocol](https://github.com/durable-streams/durable-streams/blob/main/PROTOCOL.md)
(§5) as a Plug, over
`Slap.Streams`. The stream's name is the full request path, under `:prefix`
(default `/v1/stream`). When mounted with `Plug.forward/4`, the mount path
precedes `:prefix` and is part of the stream name.

It does not authenticate: every request is allowed. Put authentication in
front of it, in the Plug pipeline that mounts it or in a proxy. An
authorization check by path must also cover the `Stream-Forked-From`
header of a `PUT`: creating a fork copies its source, so it reads that
path. With authentication, set `:private_cache`.

Options:

  * `:prefix` - only paths under it are streams (default `"/v1/stream"`).
  * `:long_poll_timeout` - ms a long-poll waits for data (default 30,000).
  * `:sse_timeout` - ms before an SSE response ends, so clients reconnect
    and CDNs can collapse them (default 60,000).
  * `:max_body` - the largest request body, in bytes (default 64 MiB). A
    larger `Content-Length` gets 413 before the body is read.
  * `:max_buffered` - bytes of request bodies this VM holds at once
    (default 512 MiB). All Streams routers in the VM share the counter;
    configure the same limit on each. A request over it gets 503 with
    `Retry-After` before its body is read.
  * `:trust_forwarded` - build the `Location` of a created stream from
    `X-Forwarded-Proto` and `X-Forwarded-Host` (set it only behind a
    proxy that sets them). Default `false`.
  * `:max_read` - about how many bytes one read returns (default 1 MiB).
  * `:max_path` - the longest stream path, in bytes (default 512; 414
    above it).
  * `:private_cache` - send `Cache-Control: private` rather than `public`
    on cacheable historical reads (§8), so that a shared cache (a CDN)
    does not serve one user's reads to another. Default `false`.
  * `:cors` - `"*"` (default), a specific origin such as
    `"https://app.example"`, or `false` to omit CORS response headers.
  * `:cluster` - Streams cluster serving these requests (default
    `Slap.Streams.Cluster`).

Each response sends a `[:slap, :streams, :http, :request]` telemetry
event.

---

*Consult [api-reference.md](api-reference.md) for complete listing*