security

Documentation

Index

• Constants
• Variables
• func Nonce(h http.Handler, opts ...Option) http.Handler
• func StoreNonce(w http.ResponseWriter, r *http.Request) (err error)
• type NonceGetter
• type NonceSetter
• type NonceStatus
  • func NonceValueFromRequest(r *http.Request) NonceStatus
  • func (s NonceStatus) Valid() bool
• type Option
  • func Age(age time.Duration) Option
  • func Getter(g NonceGetter) Option
  • func Logger(l handler.Logger) Option
  • func Setter(s NonceSetter) Option

Constants

const (
	// NonceNotRequested states that the request doesn't contain nonce data.
	NonceNotRequested nonceStatus = iota
	// NonceValid states that the request nonce exists and is valid.
	NonceValid
	// NonceInvalid states that the request nonce doesn't exist or has expired.
	NonceInvalid
)

Variables

var (
	// TimeRandomGenerator creates string content for a nonce using
	// the current time and a random integer.
	TimeRandomGenerator = Option{func(o *options) {
		o.generator = timeRandomGenerator
	}}
)

Functions

func Nonce

func Nonce(h http.Handler, opts ...Option) http.Handler

Nonce returns a handler that will check each request for the existence of a nonce. If a nonce exists, it will be checked for expiration. A status will be recorded in the request's context, indicating whether there was a nonce in the request, and if so, whether it is valid or expired.

The recorded status can later be obtained using the NonceValueFromRequest function.

A nonce can be set for later checking using the StoreNonce function.

func StoreNonce

func StoreNonce(w http.ResponseWriter, r *http.Request) (err error)

StoreNonce generates and stores a nonce in the outgoing response.

Types

type NonceGetter

type NonceGetter interface {
	GetNonce(r *http.Request) string
}

NonceGetter is used by the handler to retrieve a nonce from a request.

type NonceSetter

type NonceSetter interface {
	SetNonce(nonce string, w http.ResponseWriter, r *http.Request) error
}

NonceSetter is used by the handler to set a nonce in the outgoing response.

type NonceStatus

type NonceStatus struct {
	Status nonceStatus
}

NonceStatus indicates the status of the nonce in the incoming request, if any.

func NonceValueFromRequest

func NonceValueFromRequest(r *http.Request) NonceStatus

NonceValueFromRequest validates a nonce in the given request, and returns the validation status.

func (NonceStatus) Valid

func (s NonceStatus) Valid() bool

Valid returns true if the nonce is valid.

type Option

type Option struct {
	// contains filtered or unexported fields
}

An Option is used to change the default behaviour of nonce handler.

func Age

func Age(age time.Duration) Option

Age sets the maximum time duration a nonce can be valid

func Getter

func Getter(g NonceGetter) Option

Getter allows the user to set the method by which a nonce is retrieved from the incoming request.

func Logger

func Logger(l handler.Logger) Option

Logger defines the logger to be used whenever detailed messages have to be printed out.

func Setter

func Setter(s NonceSetter) Option

Setter allows the user to set the method by which a nonce is stored in the outgoing response.