authorization

Documentation

Index

• func CSRFProtector(allowedOrigins []string) func(http.Handler) http.Handler
• func CSRFTokenHeader(w http.ResponseWriter, r *http.Request)
• func ServerAuthorizer(tc *tls.Config, allowedOrigins []string) func(http.Handler) http.Handler

Functions

func CSRFProtector

func CSRFProtector(allowedOrigins []string) func(http.Handler) http.Handler

CSRFProtector adds a CSRF protection middleware to the chain if the program is not running in development mode.

func CSRFTokenHeader

func CSRFTokenHeader(w http.ResponseWriter, r *http.Request)

CSRFTokenHeader writes masked CSRF token in a HTTP response header.

func ServerAuthorizer

func ServerAuthorizer(tc *tls.Config, allowedOrigins []string) func(http.Handler) http.Handler

ServerAuthorizer uses two models to authorize incoming requests:

• if the request comes from a trusted client authenticated using mutual TLS, it is authorized.
• if the request comes from a web browser (directly or via a single-page application), it is authorized only if it meets CORS middleware prerequisites (which depend on the development mode setting and the configuration of the application).
• if none of the above methods authorized the request, it is denied.