v1.5.0

v1.5.0

Safer redirects

Resterm no longer forwards credentials to another origin unless you allow it.

forward-credentials-on-redirect accepts:

• false or none: never forward credentials. This is the default.
• One or more exact origins: only forward to those origins.
• true, all, or any: allow every origin.

# Allow one origin
# @setting forward-credentials-on-redirect https://cdn.example.com

# Allow several origins
# @setting forward-credentials-on-redirect https://cdn.example.com, https://api.example.com

# Allow every origin
# @setting forward-credentials-on-redirect true

Cookies are never copied across origins. Credentials are also removed when redirecting from HTTPS to HTTP. OAuth token requests cannot leave the token endpoint's origin.

Resterm now hides more secrets in history, Explain output, errors, and OTLP traces.

New limits

The following settings are available:

• max-redirects: Defaults to 10. Use 0, none, or off to stop at the first redirect.
• max-response-size: Defaults to 32mb, measured after decompression. Use 0, none, off, or unlimited to remove the limit.
• sse-max-line-bytes: Defaults to 4mb.
• sse-max-event-bytes: Defaults to 8mb.
• ws-max-message-bytes: Defaults to 32kb.

Sizes can use bytes, kb, kib, mb, mib, gb, or gib.

# @settings max-redirects=20 max-response-size=100mb
# @settings sse-max-line-bytes=16mb sse-max-event-bytes=32mb
# @setting ws-max-message-bytes 1mb

SSE and WebSocket limits can also be changed for one request:

# @sse max-line-bytes=16mb max-event-bytes=32mb
GET https://example.com/events

# @websocket max-message-bytes=1mb
WEBSOCKET wss://example.com/socket

Stream limits require a positive size and cannot be disabled. These settings work at environment, file, and request level. Request settings take priority. The @sse and @websocket options take priority for their request.

The CLI also supports --max-redirects and --max-response-size.

Streams and scripts

Broken SSE and WebSocket streams now fail the request while keeping the transcript. Normal limits such as max-events, max-bytes, idle, and duration still finish successfully.

Stream summaries now report dropped events:

# @assert stream.summary().dropped == 0

Scripts now stop after 30 seconds. Headless runs return exit code 26 for stream failures and 130 when cancelled. The headless Go API adds HTTPOptions.MaxRedirects and HTTPOptions.MaxResponseBytes. Existing keyed struct literals continue to work.