middleware

func CSRFProtection ¶

func CSRFProtection(exemptPaths []string) func(http.Handler) http.Handler

CSRFProtection returns a CSRF protection middleware using gorilla/csrf Paths in exemptPaths are excluded from CSRF checks (exact path match, not prefix)

func ClientIP ¶ added in v0.44.18

func ClientIP(next http.Handler) http.Handler

ClientIP extracts the real client IP, trusting X-Forwarded-For only from localhost (Caddy proxy)

func ExemptFromCSRF ¶

func ExemptFromCSRF(paths []string) func(http.Handler) http.Handler

ExemptFromCSRF is kept for backwards compatibility but not used Use CSRFProtection(exemptPaths) instead

func GetCSPNonce ¶ added in v0.44.18

func GetCSPNonce(r *http.Request) string

GetCSPNonce retrieves the CSP nonce from the request context. Returns an empty string if no nonce is found (e.g., middleware not applied).

func GetClientIP ¶ added in v0.44.18

func GetClientIP(r *http.Request) string

GetClientIP retrieves client IP from request context

func NewCORS ¶

func NewCORS() func(http.Handler) http.Handler

func RateLimit ¶

func RateLimit() func(http.Handler) http.Handler

RateLimit returns rate limiting middleware using chi/httprate

func RateLimitByEndpoint ¶

func RateLimitByEndpoint(requests int, window time.Duration) func(http.Handler) http.Handler

RateLimitByEndpoint returns middleware that rate limits per endpoint

func RateLimitByKey ¶

func RateLimitByKey(requests int, window time.Duration, keyFunc httprate.KeyFunc) func(http.Handler) http.Handler

RateLimitByKey returns middleware that rate limits using custom key function

func RedisRateLimitMiddleware ¶

func RedisRateLimitMiddleware(client *redis.Client) func(http.Handler) http.Handler

func SecurityHeaders ¶

func SecurityHeaders() func(http.Handler) http.Handler

SecurityHeaders returns a middleware that sets comprehensive security headers. It configures headers for clickjacking protection, XSS protection, CSP with nonce, referrer policy, permissions policy, HSTS (production only), and removes fingerprinting headers like Server and X-Powered-By.

func SecurityHeadersWithNonce ¶ added in v0.44.18

func SecurityHeadersWithNonce() func(http.Handler) http.Handler

SecurityHeadersWithNonce returns a middleware that sets security headers including a randomly generated CSP nonce stored in the request context.

func SessionRefresh ¶ added in v0.44.18

func SessionRefresh(db *sql.DB) func(http.Handler) http.Handler

SessionRefresh extends session expiration on activity (sliding window). It updates last_activity and expires_at if the session is still valid and the last activity was less than 1 hour ago.