Engineering case study · fictional publisher
The Lantern Ledger wants to publish What happens to a city after its last train? Visitors can read a teaser; simulated subscribers get the complete story. The newspaper and article are fictional. A problem encountered during confidential contracting work prompted this reconstruction; no client identity, proprietary implementation or customer outcome is presented here.
A hidden article has already been delivered
A blur, overlay or JavaScript subscription prompt can change what a page displays. If the full article is already in its HTML, embedded state or downloaded data, the browser has received it. Hiding those bytes does not establish permission to read them. A flag in localStorage is also controlled by the browser; it cannot be the server’s authority for access.
Check entitlement before rendering
- A reader requests the page. Rust looks up an opaque session cookie in its own session store.
- Without an active grant, the handler renders only the public headline, teaser and subscription form. The protected body is not passed into that response.
- Choose Simulate subscription. An ordinary POST gives this demo session an entitlement, then redirects to a new server-rendered page at the article.
- The next request checks that entitlement and returns the full story. Refresh checks it again. Reset subscription revokes the session’s access.
The HttpOnly cookie identifies a server-held session; it does not contain a trusted browser-supplied “paid” flag. This teaching demo lets any visitor simulate a subscription. It takes no payment and creates no account. Grants live only in server memory for the session’s absolute 30-minute lifetime; refresh does not extend it. Reset, expiry or a server restart removes access.
Where Forma fits
Forma compiles the supported TSX page structure into FMIR. Rust supplies typed props and renders the selected page at request time. This route has no interactive island and needs no executable JavaScript: its forms make ordinary requests, and the response already contains the appropriate reading experience.
The entitlement check is application code in the Rust handler. Forma’s native renderer does not authenticate readers, verify purchases or supply subscription policy. Other server-rendering stacks can enforce the same boundary; the useful property here is that the application decides which content may enter the rendering inputs.
Check every way the article could leave the server
- HTML and state: the visitor response must omit the protected body, including comments, data attributes and serialized props.
- APIs and alternate routes: previews, exports and article endpoints need the same entitlement check. A protected page cannot compensate for a public content API.
- Caches: session-dependent responses must not become a shared public cached article. This demo uses no-store responses; a real deployment must preserve that policy through its proxy or CDN.
- Static assets and downloads: the protected fixture stays outside the public static output and source-download export. Do not place subscription content in JavaScript bundles, source maps, search indexes or publicly served files.
This follows the OWASP Authorization Cheat Sheet: deny access by default, verify permissions on every request and include static resources in the access-control design.
Try the boundary with JavaScript disabled
Open the demo as a new reader and inspect the initial response. Choose Simulate subscription, read the expanded article and refresh. Then choose Reset subscription and request the page again. Check whether the server sends the protected body for each request; inspecting the visible overlay alone would not answer that question.
A reader who receives the full story can copy or save it. Reset cannot erase an earlier copy. This example demonstrates access control before delivery, not copy protection or an unbreakable paywall. A production subscription service also needs verified identity and payments, a durable entitlement store, session lifecycle controls and deployment-specific testing.
Continue with the Rust response guide, declared props contract and Forma security guide.