Method RegisterRoutes

Modules/RESTAPI/src/mitkRestServer.cpp:821–1201

}

void RestServer::RegisterRoutes()
{
  const std::string apiBase = "/api/v1";

  // Enable CORS for browser-based clients. When authentication is required, restrict
  // the allowed origin to localhost to prevent arbitrary web pages from reading
  // authenticated responses. With auth disabled, wildcard is acceptable for a local
  // development server.
  const std::string corsOrigin = m_PendingConfig.requireAuth ? "http://localhost" : "*";
  m_Server->set_default_headers({
    {"Access-Control-Allow-Origin", corsOrigin},
    {"Access-Control-Allow-Methods", "GET, POST, PUT, PATCH, DELETE, OPTIONS"},
    {"Access-Control-Allow-Headers", "Content-Type, Accept, Authorization, X-MITK-Transfer-Mode"}
  });

  // Handle preflight OPTIONS requests for any route
  m_Server->Options(".*", [](const httplib::Request& /*req*/, httplib::Response& res) {
    res.status = 204;
  });

  // Install security middleware as pre-routing handler.
  // This runs before any route handler and can short-circuit the request.
  m_Server->set_pre_routing_handler(
    [this](const httplib::Request& req, httplib::Response& res) -> httplib::Server::HandlerResponse {
      // 1. Client IP access check
      if (!this->CheckClientAccess(req, res))
      {
        return httplib::Server::HandlerResponse::Handled;
      }

      // 2. Rate limiting check
      if (!this->CheckRateLimit(req, res))
      {
        return httplib::Server::HandlerResponse::Handled;
      }

      // 3. Authentication check
      if (!this->CheckAuthentication(req, res))
      {
        return httplib::Server::HandlerResponse::Handled;
      }

      // All checks passed - continue to route matching
      return httplib::Server::HandlerResponse::Unhandled;
    });

  // Health endpoints
  m_Server->Get(apiBase + "/health",
    [this](const httplib::Request& req, httplib::Response& res) {
      m_HealthController->HandleGET_health(req, res);
      this->RecordRequest(req.path, "GET", res.status, req.remote_addr);
    });

  m_Server->Get(apiBase + "/info",
    [this](const httplib::Request& req, httplib::Response& res) {
      m_HealthController->HandleGET_info(req, res);
      this->RecordRequest(req.path, "GET", res.status, req.remote_addr);
    });