Documentation
¶
Index ¶
- Constants
- Variables
- func CheckWebSocketOrigin(r *http.Request) bool
- func GenerateToken(userID uint, email string, isAdmin bool, secret string, expireSeconds int) (string, error)
- func IsWebSocketOriginAllowed(r *http.Request, allowedOrigins []string) bool
- func Redact(s string) string
- func RedactIP(ip string) string
- func RedactJSON(jsonStr string) string
- func RedactMap(data map[string]any) map[string]any
- type Claims
- type LogSafe
Constants ¶
View Source
const LegacyTokenIssuer = "v2board"
LegacyTokenIssuer is the iss claim of the kernel's HS256 tokens.
Variables ¶
View Source
var SensitiveKeys = []string{
"password",
"secret",
"api_key",
"apikey",
"api-key",
"token",
"access_token",
"refresh_token",
"auth_key",
"private_key",
"credential",
}
SensitiveKeys 敏感字段名列表
Functions ¶
func CheckWebSocketOrigin ¶
CheckWebSocketOrigin applies the server CORS origin allowlist to WebSocket upgrades while still allowing same-host browser upgrades and non-browser clients that do not send an Origin header.
func GenerateToken ¶
func GenerateToken(userID uint, email string, isAdmin bool, secret string, expireSeconds int) (string, error)
GenerateToken 生成JWT token
func IsWebSocketOriginAllowed ¶
IsWebSocketOriginAllowed validates a WebSocket Origin header against the request host and an explicit origin allowlist.
Types ¶
type Claims ¶
type Claims struct {
UserID uint `json:"user_id"`
Email string `json:"email"`
IsAdmin bool `json:"is_admin"`
// SessionID (sid) identifies one login, so a single session can be
// revoked. Tokens issued before it was added have none.
SessionID string `json:"sid,omitempty"`
// TokenVersion (tv) is set by the identity module's tokens; HS256 tokens
// carry none, which counts as 0.
TokenVersion uint64 `json:"tv,omitempty"`
jwt.RegisteredClaims
}
func ParseTokenWithSecret ¶
ParseTokenWithSecret verifies an HS256 token signed with secret. The algorithm is pinned, so a token signed with another HMAC variant or any other algorithm is rejected, and iss, exp and iat are required. Revocation is checked by internal/authn, which every request path uses.
Source Files
Click to show internal directories.
Click to hide internal directories.