Rack provides a minimal, modular, and adaptable interface for developing web applications in Ruby. By wrapping HTTP requests and responses in the simplest way possible, it unifies and distills the bridge between web servers, web frameworks, and web application into a single method call.
The exact details of this are described in the Rack Specification, which all Rack applications should conform to.
| Version | Support |
|---|---|
| 3.0.x | Bug fixes and security patches. |
| 2.2.x | Security patches only. |
| <= 2.1.x | End of support. |
Please see the Security Policy for more information.
This is the latest version of Rack. It contains API improvements but also some breaking changes. Please check the Upgrade Guide for more details about migrating servers, middlewares and applications designed for Rack 2 to Rack 3. For detailed information on specific changes, check the Change Log.
This version of Rack is receiving security patches only, and effort should be made to move to Rack 3.
Starting in Ruby 3.4 the base64 dependency will no longer be a default gem,
and may cause a warning or error about base64 being missing. To correct this,
add base64 as a dependency to your project.
Add the rack gem to your application bundle, or follow the instructions provided by a supported web framework:
# Install it generally:
$ gem install rack
# or, add it to your current application gemfile:
$ bundle add rack
If you need features from Rack::Session or bin/rackup please add those gems separately.
$ gem install rack-session rackup
Create a file called config.ru with the following contents:
run do |env|
[200, {}, ["Hello World"]]
end
Run this using the rackup gem or another supported web server.
$ gem install rackup
$ rackup
$ curl http://localhost:9292
Hello World
Rack is supported by a wide range of servers, including:
You will need to consult the server documentation to find out what features and limitations they may have. In general, any valid Rack app will run the same on all these servers, without changing anything.
Rack provides a separate gem, rackup which is
a generic interface for running a Rack application on supported servers, which
include WEBRick, Puma, Falcon and others.
These frameworks and many others support the Rack Specification:
Between the server and the framework, Rack can be customized to your applications needs using middleware. Rack itself ships with the following middleware:
Rack::CommonLogger for creating Apache-style logfiles.Rack::ConditionalGet for returning Not
Modified
responses when the response has not changed.Rack::Config for modifying the environment before processing the request.Rack::ContentLength for setting a content-length header based on body
size.Rack::ContentType for setting a default content-type header for responses.Rack::Deflater for compressing responses with gzip.Rack::ETag for setting etag header on bodies that can be buffered.Rack::Events for providing easy hooks when a request is received and when
the response is sent.Rack::Files for serving static files.Rack::Head for returning an empty body for HEAD requests.Rack::Lint for checking conformance to the Rack Specification.Rack::Lock for serializing requests using a mutex.Rack::Logger for setting a logger to handle logging errors.Rack::MethodOverride for modifying the request method based on a submitted
parameter.Rack::Recursive for including data from other paths in the application, and
for performing internal redirects.Rack::Reloader for reloading files if they have been modified.Rack::Runtime for including a response header with the time taken to process
the request.Rack::Sendfile for working with web servers that can use optimized file
serving for file system paths.Rack::ShowException for catching unhandled exceptions and presenting them in
a nice and helpful way with clickable backtrace.Rack::ShowStatus for using nice error pages for empty client error
responses.Rack::Static for more configurable serving of static files.Rack::TempfileReaper for removing temporary files creating during a request.All these components use the same interface, which is described in detail in the Rack Specification. These optional components can be used in any way you wish.
If you want to develop outside of existing frameworks, implement your own ones, or develop middleware, Rack provides many helpers to create Rack applications quickly and without doing the same web stuff all over:
Rack::Request which also provides query string parsing and multipart
handling.Rack::Response for convenient generation of HTTP replies and cookie
handling.Rack::MockRequest and Rack::MockResponse for efficient and quick testing
of Rack application without real HTTP round-trips.Rack::Cascade for trying additional Rack applications if an application
returns a not found or method not supported response.Rack::Directory for serving files under a given directory, with directory
indexes.Rack::MediaType for parsing content-type headers.Rack::Mime for determining content-type based on file extension.Rack::RewindableInput for making any IO object rewindable, using a temporary
file buffer.Rack::URLMap to route to multiple applications inside the same process.Rack exposes several configuration parameters to control various features of the implementation.
param_depth_limitRack::Utils.param_depth_limit = 32 # default
The maximum amount of nesting allowed in parameters. For example, if set to 3, this query string would be allowed:
?a[b][c]=d
but this query string would not be allowed:
?a[b][c][d]=e
Limiting the depth prevents a possible stack overflow when parsing parameters.
multipart_file_limitRack::Utils.multipart_file_limit = 128 # default
The maximum number of parts with a filename a request can contain. Accepting too many parts can lead to the server running out of file handles.
The default is 128, which means that a single request can't upload more than 128 files at once. Set to 0 for no limit.
Can also be set via the RACK_MULTIPART_FILE_LIMIT environment variable.
(This is also aliased as multipart_part_limit and RACK_MULTIPART_PART_LIMIT for compatibility)
multipart_total_part_limitThe maximum total number of parts a request can contain of any type, including both file and non-file form fields.
The default is 4096, which means that a single request can't contain more than 4096 parts.
Set to 0 for no limit.
Can also be set via the RACK_MULTIPART_TOTAL_PART_LIMIT environment variable.
See CHANGELOG.md.
See CONTRIBUTING.md for specific details about how to make a contribution to Rack.
Please post bugs, suggestions and patches to GitHub Issues.
Please check our Security Policy for responsible disclosure and security bug reporting process. Due to wide usage of the library, it is strongly preferred that we manage timing in order to provide viable patches at the time of disclosure. Your assistance in this matter is greatly appreciated.
rack-contribThe plethora of useful middleware created the need for a project that collects
fresh Rack middleware. rack-contrib includes a variety of add-on components
for Rack and it is easy to contribute new modules.
rack-sessionProvides convenient session management for Rack.
The Rack Core Team, consisting of
and the Rack Alumni
would like to thank:
Rack::Deflater.Rack::ContentType.Rack::Response interface.Rack::Response.Rack is released under the MIT License.
FAQs
Unknown package
We found that rack demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
pnpm 10 blocks lifecycle scripts by default to improve security, addressing supply chain attack risks but sparking debate over compatibility and workflow changes.
Product
Socket now supports uv.lock files to ensure consistent, secure dependency resolution for Python projects and enhance supply chain security.
Research
Security News
Socket researchers have discovered multiple malicious npm packages targeting Solana private keys, abusing Gmail to exfiltrate the data and drain Solana wallets.