Conditions

In block syntax, conditions are written in the rule header (before { ... }). In YAML, the same expression is written in on:. Conditions can be combined using logical operators.

Logical Operators

Syntax

<condition> <args> [[ | <condition> <args> ] [ & <condition> <args> ]]...

Available Conditions

Form Field Conditions

Both form and postform conditions match form field values, but they resolve values differently:

postform Precedence Order

• Matches request body form fields only (no query-string fallback)

form Precedence Order

1. Form body fields (POST/PUT/PATCH, urlencoded or multipart)
2. Query parameters (fallback)

Example

# For POST /example?action=query with body action=form
postform action form     # Matches body value only
form action form         # Matches form value first; query can be fallback

Basic Authentication

For basic_auth conditions, the password must be bcrypt hashed. Generate the hash using:

htpasswd -nbB '' your-password | cut -c 2-

Basic Auth Concept

To protect a resource, you need to:

• Require basic authentication by default
• Allow specific users to pass through (or proxy to another service) with valid credentials

Example Basic Auth Rule

default {
  require_basic_auth "Restricted Area"
}

basic_auth user1 "$2y$10$..." | basic_auth user2 "$2y$10$..." {
  pass
}

Path Pattern Syntax

The path condition supports three types of patterns for matching request paths:

String Matching

path /api/users # Exact match for /api/users

Glob Patterns

Glob patterns use github.com/gobwas/glob. GoDoxy compiles them without separators, so * and ? match / the same way they match any other character. ** also matches any sequence; with no separators it is equivalent to * for /.

A [...] class is either one range ([a-z], [0-9]) or a set of listed characters ([abc], [!_], [-abcdef0123456789]), not both. Mixed forms such as [a-f0-9] or [a-f0-9-] do not compile. Put a literal - first or last in a set ([-abc] or [abc-]). Unclosed { / [ and a trailing \ are syntax errors.

Advanced Glob Examples

# Match common web asset files
path glob("/static/**/*.{css,js,png,jpg,jpeg,gif,svg}")

# Match versioned API paths (one digit; * still matches nested segments)
path glob("/api/v[0-9]/*")

# Hex-and-hyphen name: list the set, do not mix ranges in one [...]
path glob("/users/[-abcdef0123456789]*/profile")

# Match date-based paths (each [0-9] is its own range)
path glob("/logs/[0-9][0-9][0-9][0-9]-[0-9][0-9]-[0-9][0-9]/*")

# Match file extensions with character classes
path glob("/uploads/*.{[Pp][Dd][Ff],[Dd][Oo][Cc][Xx]}")

# Exclude names whose first character is underscore
path glob("/images/[!_]*")

Regular Expressions

path regex("^/api/v[0-9]+/users/[a-f0-9-]{36}$")  # Match specific UUID pattern
path regex("^/files/[0-9]{4}-[0-9]{2}-[0-9]{2}$")  # Match date pattern