middleware

Documentation

Index

• func Cors(opt CorsOptions) func(http.Handler) http.Handler
• func RealIP(h http.Handler) http.Handler
• func Recover(next http.Handler) http.Handler
• func RequestLog(h http.Handler) http.Handler
• func SecureHeaders(opt SecureHeadersOptions) func(http.Handler) http.Handler
• func SetLogger(log *slog.Logger)
• type CorsOptions
• type SecureHeadersOptions

Functions

func Cors

func Cors(opt CorsOptions) func(http.Handler) http.Handler

Cors is a middleware that adds Cross-Origin Resource Sharing headers to the response.

func RealIP

func RealIP(h http.Handler) http.Handler

RealIP is a middleware that sets a http.Request's RemoteAddr to the results of parsing either the True-Client-IP, X-Real-IP or the X-Forwarded-For headers (in that order).

This middleware should be inserted fairly early in the middleware stack to ensure that subsequent layers (e.g., request loggers) which examine the RemoteAddr will see the intended value.

You should only use this middleware if you can trust the headers passed to you (in particular, the three headers this middleware uses), for example because you have plaả3ced a reverse proxy like HAProxy or nginx in front of chi. If your reverse proxies are configured to pass along arbitrary header values from the client, or if you use this middleware without a reverse proxy, malicious clients will be able to make you very sad (or, depending on how you're using RemoteAddr, vulnerable to an attack of some sort).

func Recover

func Recover(next http.Handler) http.Handler

func RequestLog

func RequestLog(h http.Handler) http.Handler

RequestLog will print server request with time and other required information

func SecureHeaders

func SecureHeaders(opt SecureHeadersOptions) func(http.Handler) http.Handler

SecureHeaders headers to secure server response

func SetLogger

func SetLogger(log *slog.Logger)

Types

type CorsOptions

type CorsOptions struct {
	AllowedOrigins []string

	// AllowedHeaders are a list of headers clients are allowed to use with.
	//
	// default: []string{"Accept", "Content-Type", "X-Requested-With"}
	AllowedHeaders []string

	// AllowedMethods are a list of methods clients are allowed to use.
	//
	// default: []string{"GET", "POST", "HEAD"}
	AllowedMethods []string

	ExposedHeaders []string

	MaxAge uint

	AllowCredentials    bool
	AllowPrivateNetwork bool
	// contains filtered or unexported fields
}

type SecureHeadersOptions

type SecureHeadersOptions struct {
	CSPDomains []string
	StrictTLS  bool
}