Documentation
¶
Overview ¶
Package adapters-nethttp-security demonstrates authentication and authorization for REST APIs built with go-codex and the net/http adapter.
Security is declared in two layers:
Spec layer (api/rest + route): security schemes and per-route requirements are declared on the Builder and RouteHandle. The OpenAPI spec output includes components/securitySchemes and per-operation security.
Runtime layer (adapters/nethttp): the adapter extracts credentials from the request (Authorization header for Bearer), runs the optional Codec format-validation (e.g. validate.JWT), then calls SecurityFunc for application-level verification (signature check, scope check, etc.).
Routes:
- POST /login — public (no security), returns a mock token
- GET /profile — secured with bearerAuth (JWT format + user scope)
- POST /admin/action — secured with bearerAuth + admin scope
SecurityFunc in this example performs a mock check (no real crypto):
- Accepts any token that starts with "valid-"
- Checks that the required scopes are present in a mock token store
A SecurityObserver is wired to log every credential rejection with the route path and scheme name.
Run with: go run ./examples/adapters-nethttp-security
Source Files