bloomBUILD•SHIP•BLOOM
Bloom Serveri18n & Security
.md
Security & Localization

i18n & Security

bloom_i18n and bloom_security deliver enterprise-grade localization, CORS controls, security headers, and sliding-window rate limiting for Bloom backend applications.

Internationalization with bloom_i18n

bloom_i18n supports standard ICU MessageFormat syntax (pluralization, select/gender cases, argument interpolation) backed by the standard intl package. BloomLocaleMiddleware parses quality-weighted Accept-Language headers:

lib/i18n.dart
dart
// lib/i18n.dart - ICU Message Formatting & Middleware
import 'package:bloom_framework/bloom_server.dart';
import 'package:bloom_i18n/bloom_i18n.dart';

void configureI18n(BloomApiRouter router) {
  final locales = BloomLocales(defaultLocale: 'en-US');

  // Register ICU MessageFormat catalogs
  locales.addLocale('en-US', {
    'welcome_user': 'Welcome back, {username}!',
    'notifications': '{count, plural, =0 {No notifications} =1 {1 notification} other {# notifications}}',
  });

  locales.addLocale('es-ES', {
    'welcome_user': '¡Bienvenido de nuevo, {username}!',
    'notifications': '{count, plural, =0 {Sin notificaciones} =1 {1 notificación} other {# notificaciones}}',
  });

  // Resolve Accept-Language header or ?locale= query parameter
  router.use(BloomLocaleMiddleware(
    defaultLocale: 'en-US',
    supportedLocales: ['en-US', 'es-ES'],
    locales: locales,
  ));

  router.get('/api/welcome', (req) {
    // Translate message using request-bound helper
    final message = req.t('welcome_user', args: {'username': 'Alice'});
    return BloomResponse.json({'locale': req.locale, 'message': message});
  });
}

Security Headers & CORS with bloom_security

bloom_security provides production-hardened middleware for BloomApiRouter:

bin/server.dart
dart
// bin/server.dart - Production Security & CORS Middleware
import 'package:bloom_framework/bloom_server.dart';
import 'package:bloom_security/bloom_security.dart';

void main() async {
  final router = BloomApiRouter();

  // 1. Strict CORS Middleware with Origin Whitelisting
  router.use(BloomAdvancedCorsMiddleware(
    allowedOrigins: ['https://myapp.com', 'https://admin.myapp.com'],
    allowedMethods: ['GET', 'POST', 'PUT', 'DELETE', 'OPTIONS'],
    allowedHeaders: ['Content-Type', 'Authorization'],
    allowCredentials: true,
    maxAge: const Duration(hours: 24),
  ));

  // 2. HTTP Security Headers (CSP, HSTS, X-Frame-Options, X-Content-Type-Options)
  router.use(const BloomSecurityHeadersMiddleware());

  // 3. Sliding-Window Rate Limiter (100 requests / minute per client IP)
  router.use(BloomRateLimitMiddleware(
    maxRequests: 100,
    window: const Duration(minutes: 1),
    whitelist: {'127.0.0.1'},
  ));

  await router.serve(port: 8080);
}

Sliding-Window IP Rate Limiting

BloomRateLimitMiddleware tracks requests per client IP across configurable sliding time windows. When limits are exceeded, the middleware returns HTTP 429 Too Many Requests with standard X-RateLimit-* and Retry-After headers.

Native WebSocket Upgrade

BloomWebSocketServer and serveWithWebSockets allow serving both standard REST endpoints and realtime WebSocket listeners simultaneously on the same HTTP port.

Previous: Jobs, Mail & StorageNext: Supabase Adapter