Documentation
¶
Overview ¶
Package security defines the security event dispatched for every security-relevant decision (failed logins, denied authorization, CSRF rejections, rate limits, invalid signatures). Subscribe to alert:
events.Listen(app.Events, func(ctx context.Context, e security.Event) error {
if e.Name == "auth.login_failed" { ... }
return nil
})
Handlers and middleware emit events through web.SecurityEvent; each one is logged and, when the app has an event bus, dispatched as an Event.
See https://github.com/AlexGalhardo/vukem/blob/main/docs/security.md.
Example ¶
package main
import (
"context"
"fmt"
"log/slog"
"github.com/AlexGalhardo/vukem/events"
"github.com/AlexGalhardo/vukem/security"
)
func main() {
bus := events.New(slog.New(slog.DiscardHandler), 0)
events.Listen(bus, func(_ context.Context, e security.Event) error {
if e.Name == "auth.login_failed" {
fmt.Println("alert:", e.Name, e.IP)
}
return nil
})
// The framework dispatches these; apps only listen.
err := bus.Dispatch(context.Background(), security.Event{
Name: "auth.login_failed", Method: "POST", Path: "/login", IP: "203.0.113.7",
})
fmt.Println(err)
}
Output: alert: auth.login_failed 203.0.113.7 <nil>
Index ¶
Examples ¶
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
This section is empty.
Types ¶
type Audit ¶ added in v0.26.0
type Audit Event
Audit describes one routine audit record emitted through web.AuditEvent (a payout recorded, a role granted). It has the fields of Event but is a distinct type, so listeners alerting on Event never see audit records:
events.Listen(app.Events, func(ctx context.Context, a security.Audit) error { ... })
Attrs never contain secrets.
type Event ¶
type Event struct {
Name string `json:"name"`
At time.Time `json:"at"`
Method string `json:"method"`
Path string `json:"path"`
IP string `json:"ip"`
RequestID string `json:"request_id,omitempty"`
Attrs map[string]any `json:"attrs,omitempty"`
}
Event describes one security event. Attrs never contain secrets.
Source Files