Document regex route, file handler and WebSocket Origin caveats

README-websocket.md

@@ -121,6 +121,8 @@ using SubProtocolSelector =
 
 The `SubProtocolSelector` receives the list of subprotocols proposed by the client (from the `Sec-WebSocket-Protocol` header) and returns the selected one. Return an empty string to decline all proposed subprotocols. A returned value that the client did not propose is ignored.
 
+The handler is called whatever the `Origin` of the handshake. A browser sends its cookies along with a WebSocket handshake that another site starts, so if cookies authenticate the connection, check `req.get_header_value("Origin")` against the origins you serve first (cross-site WebSocket hijacking).
+
 ### WebSocket (Server-side)
 
 Passed to the handler registered with `Server::WebSocket()`. The handler runs in a dedicated thread per connection.

README.md

@@ -441,6 +441,8 @@ svr.set_file_request_handler([](const Request &req, Response &res) {
 });
 ```
 
+It is not called for a `HEAD` request, nor when the file has not changed and `304 Not Modified` is sent, so do not rely on it for access control; use `set_pre_routing_handler()` for that.
+
 ### Logging
 
 cpp-httplib provides separate logging capabilities for access logs and error logs, similar to web servers like Nginx and Apache.
@@ -1808,6 +1810,8 @@ NOTE
 > svr.Get("/users/:id", handler);           // Path parameters
 > svr.Get(R"(/api/v\d+/.*)", handler);     // Regex route, limited to short paths
 > ```
+>
+> The limit is no guarantee on a thread with a small stack, such as one of musl's 128KB threads, where a pattern like `(\w|-)+` can already overflow on a shorter path; lower the limit there. Nor does it bound the time a pattern with nested repetition, such as `((\w+-?)+)`, can take to fail on a few dozen characters. Keep regex routes simple.
 
 ### g++