middleware

Documentation

Overview

Package middleware provides http middleware

Index

• Constants
• func CORS(allowedOrigins []string, debug bool) gorouter.MiddlewareFunc
• func GrantAccessFor(permission identity.Permission) func(next http.Handler) http.Handler
• func HSTS() gorouter.MiddlewareFunc
• func LimitRequestBody(n int64) gorouter.MiddlewareFunc
• func Logger() gorouter.MiddlewareFunc
• func Metrics() gorouter.MiddlewareFunc
• func RateLimit(r rate.Limit, b int, frequency time.Duration) gorouter.MiddlewareFunc
• func Recover() gorouter.MiddlewareFunc
• func WithContainer(requestContainer gocontainer.Container) gorouter.MiddlewareFunc
• func WithMetadata() gorouter.MiddlewareFunc
• func XSS() gorouter.MiddlewareFunc

Examples

• HSTS
• Logger
• Recover
• XSS

Constants

const InternalRequestMetadataKey = "m"

Functions

func CORS

func CORS(allowedOrigins []string, debug bool) gorouter.MiddlewareFunc

CORS replies to request with cors header and handles preflight request it is enhancement to improve middleware usability instead of wrapping every handler

func GrantAccessFor

func GrantAccessFor(permission identity.Permission) func(next http.Handler) http.Handler

GrantAccessFor returns Status Unauthorized if Identity is not set within request's context or user does not have required permission

func HSTS

func HSTS() gorouter.MiddlewareFunc

HSTS HTTP Strict Transport Security is an opt-in security enhancement that is specified by a web application through the use of a special response header

Example

package main

import (
	"fmt"
	"net/http"
	"net/http/httptest"

	"github.com/bradishungry/go-api-learning/pkg/http/middleware"
)

func main() {
	m := middleware.HSTS()
	h := m(http.HandlerFunc(func(_ http.ResponseWriter, _ *http.Request) {}))

	w := httptest.NewRecorder()
	req, _ := http.NewRequest("GET", "/", nil)

	h.ServeHTTP(w, req)

	fmt.Printf("%s", w.Header().Get("Strict-Transport-Security"))

}

Output:

max-age=63072000; includeSubDomains

func LimitRequestBody

func LimitRequestBody(n int64) gorouter.MiddlewareFunc

LimitRequestBody limits the request body

func Logger

func Logger() gorouter.MiddlewareFunc

Logger wraps http.Handler with a logger middleware

Example

package main

import (
	"net/http"
	"net/http/httptest"

	"github.com/bradishungry/go-api-learning/pkg/http/middleware"
)

func main() {
	m := middleware.Logger()
	h := m(http.HandlerFunc(func(_ http.ResponseWriter, _ *http.Request) {}))

	w := httptest.NewRecorder()
	req, _ := http.NewRequest("GET", "/", nil)

	h.ServeHTTP(w, req)
}

func Metrics

func Metrics() gorouter.MiddlewareFunc

Metrics updates program counters.

func RateLimit

func RateLimit(r rate.Limit, b int, frequency time.Duration) gorouter.MiddlewareFunc

RateLimit returns a new HTTP middleware that allows request per visitor (IP) up to rate r and permits bursts of at most b tokens. Please add before metrics if used together

func Recover

func Recover() gorouter.MiddlewareFunc

Recover middleware recovers from panic

Example

package main

import (
	"net/http"
	"net/http/httptest"

	"github.com/bradishungry/go-api-learning/pkg/http/middleware"
)

func main() {
	m := middleware.Recover()
	handler := m(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
		panic("error")
	}))

	// We will mock request for this example
	w := httptest.NewRecorder()
	req, _ := http.NewRequest("GET", "/", nil)

	handler.ServeHTTP(w, req)
}

func WithContainer

func WithContainer(requestContainer gocontainer.Container) gorouter.MiddlewareFunc

WithContainer wraps http.Handler with a container middleware

func WithMetadata

func WithMetadata() gorouter.MiddlewareFunc

WithMetadata adds Metadata to requests context

func XSS

func XSS() gorouter.MiddlewareFunc

XSS sets xss response header types

Example

package main

import (
	"fmt"
	"net/http"
	"net/http/httptest"

	"github.com/bradishungry/go-api-learning/pkg/http/middleware"
)

func main() {
	m := middleware.XSS()
	h := m(http.HandlerFunc(func(_ http.ResponseWriter, _ *http.Request) {}))

	w := httptest.NewRecorder()
	req, _ := http.NewRequest("GET", "/", nil)

	h.ServeHTTP(w, req)

	fmt.Printf("%s\n", w.Header().Get("X-Content-Type-Options"))
	fmt.Printf("%s", w.Header().Get("X-Frame-Options"))

}

Output:

nosniff
DENY