Skip to main content
zerotal

Documentation

Documentation / @zerotal/inertia / SsrHandler

Class: SsrHandler

Defined in: inertia/src/SsrHandler.ts:51

POST /__ssr — Inertia server-side rendering endpoint.

Accepts the Inertia SSR wire format: { component, props, url } Returns { body, head } — the rendered HTML string and any head injections.

The component is resolved from //.{vue,tsx} (pagesDir defaults to the configured inertia.pagesDir, i.e. resources/js/pages) and rendered with the matching framework runtime — Vue (@inertiajs/vue3 + vue/server-renderer) for .vue files, React (react-dom/server) for .tsx.

App authors never instantiate this directly — InertiaProvider registers the route when SSR is enabled. Turn it on by setting ssr: true in config/inertia.ts, and install the server renderer for the framework(s) in use.

Example

// config/inertia.ts
export default InertiaConfig({ ssr: true }); // registers POST /__ssr

Constructors

Constructor

new SsrHandler(options?): SsrHandler

Defined in: inertia/src/SsrHandler.ts:57

Parameters

options?

pagesDir overrides where page components are resolved from; defaults to <cwd>/<inertia.pagesDir>.

pagesDir?

string

Returns

SsrHandler

Methods

isAuthorized()

static isAuthorized(http): boolean

Defined in: inertia/src/SsrHandler.ts:136

Whether this request may reach the SSR renderer.

Two ways in, and nothing else:

  • the peer is on loopback — the normal case, where the SSR client is the app's own Node/Bun renderer talking to itself;
  • the request carries SSR_SECRET_HEADER matching inertia.ssrSecret, for a renderer running on another host.

Everyone else gets a 404 rather than a 403, because whether this route exists is not information a stranger needs. Without the check the endpoint was unauthenticated, unthrottled, and cheap CPU amplification for anyone who found it.

Parameters

http

HttpContext

The request context.

Returns

boolean

true when the request is permitted.