Apache Pekko HTTP 1.4

Last reviewed Sep 24, 2026

Export as PDF

Prompt Details

Prompt Composition

2prompts
  1. Java 21124 lines · 3.9K tokens
  2. Apache Pekko HTTP 1.472 lines · 4.2K tokens
Total196 lines · 8K tokens

CWE Coverage

  • 20
  • 22
  • 59
  • 78
  • 79
  • 88
  • 89
  • 95
  • 117
  • 190
  • 197
  • 208
  • 209
  • 287
  • 295
  • 297
  • 306
  • 319
  • 323
  • 327
  • 338
  • 347
  • 352
  • 362
  • 367
  • 378
  • 427
  • 434
  • 459
  • 470
  • 471
  • 488
  • 489
  • 494
  • 502
  • 522
  • 532
  • 552
  • 598
  • 611
  • 613
  • 614
  • 653
  • 732
  • 759
  • 770
  • 772
  • 776
  • 807
  • 862
  • 863
  • 915
  • 916
  • 918
  • 922
  • 942
  • 1004
  • 1275
  • 1333

Prompt Preview

Apply the Java 21 prompt first. These rules cover Apache Pekko HTTP 1.4's Java and Scala HTTP APIs, routing DSL, optional CORS and caching modules, and streaming lifecycle, and were checked against 1.4.0. Apply the language baseline's validation, serialization, filesystem, TLS, and logging rules to the application code behind these APIs.

Dependencies and deployment boundaries

  • Keep every pekko-http-* module on one release with the matching Scala binary suffix, managed through pekko-http-bom where supported, and move them together. Declare pekko-stream explicitly and keep Pekko Core modules on one compatible, patched version; HTTP 1.4.0 recommends Core 1.1.x or later 1.x rather than 1.0.x. Match pekko-stream-testkit to Core and pekko-http-testkit to HTTP.
  • Put a maintained reverse proxy or load balancer in front of public services, as Pekko HTTP's security model recommends. Restrict the backend listener to that ingress and configure request-size, duration, connection, and rate limits there as well as in Pekko; keep management and diagnostic routes on explicitly restricted interfaces or routes.
  • Configure HTTPS with Http().newServerAt(...).enableHttps(ConnectionContext.httpsServer(...)) when TLS reaches Pekko. Protect the proxy-to-backend hop according to its trust boundary. If client certificates establish identity, require client authentication with SSLEngine.setNeedClientAuth(true) and authorize the verified certificate identity.
  • Enforce allowed public hosts with host directives or equivalent ingress checks before routing or building absolute