Serving Static Files

Mapping /static/css/main.css to a file on disk is dangerous if done naively:

filepath = "./public" + request.path  # "./public/static/css/main.css"

A request for /../etc/passwd resolves to ./public/../etc/passwd — outside your safe directory. Always canonicalize the path and check it stays inside the root:

For each file, set the right Content-Type from the extension:

.html -> text/html; charset=utf-8
.css  -> text/css
.js   -> application/javascript
.png  -> image/png
.jpg  -> image/jpeg
.svg  -> image/svg+xml
.json -> application/json
.txt  -> text/plain; charset=utf-8

Anything unrecognized -> application/octet-stream (the browser will offer to download it).

Production servers also handle:

• If-Modified-Since -> 304 (cache validation)
• Range: bytes=... -> 206 (resumable downloads, video seek)
• gzip / br content encoding (compression)