httpclient

package
v0.58.0 Latest Latest
Warning

This package is not in the latest version of its module.

Go to latest
Published: Oct 26, 2026 License: Apache-2.0 Imports: 8 Imported by: 0

Documentation

Overview

Package httpclient bounds an API client's requests to its configured origin.

Example
package main

import (
	"context"
	"errors"
	"fmt"
	"net/http"

	"github.com/Tangerg/scope/core/httpclient"
)

func main() {
	ctx := context.Background()
	host := &http.Client{}
	client, err := httpclient.New(ctx, httpclient.Config{
		HTTPClient: host,
		BaseURL:    "https://api.example/v1",
	})
	if err != nil {
		panic(err)
	}
	redirect, err := http.NewRequestWithContext(ctx, http.MethodGet, "https://api.example:9443/result", nil)
	if err != nil {
		panic(err)
	}
	err = client.CheckRedirect(redirect, nil)
	fmt.Println("independent client:", client != host)
	fmt.Println("host transport unchanged:", host.Transport == nil)
	fmt.Println("other port rejected:", errors.Is(err, httpclient.ErrOriginNotAllowed))
}
Output:
independent client: true
host transport unchanged: true
other port rejected: true

Index

Examples

Constants

This section is empty.

Variables

View Source
var ErrOriginNotAllowed = errors.New("httpclient: request origin is not authorized")

ErrOriginNotAllowed prevents an API credential or request body from reaching an origin other than the one configured by its owner.

Functions

func New

func New(_ context.Context, config Config) (*http.Client, error)

New copies the client value before applying origin restrictions, so SDK initialization and redirect policy changes cannot mutate the host's client. The host retains ownership of the shared transport and cookie jar. Its redirect policy runs before the final destination and authority checks.

Types

type Config

type Config struct {
	// A nil Transport, including a typed nil, uses http.DefaultTransport.
	HTTPClient *http.Client
	BaseURL    string
}

type Origin

type Origin struct {
	// contains filtered or unexported fields
}

Origin is an immutable HTTP origin. Equality includes the scheme, host, and effective port; its zero value authorizes no requests.

func NewOrigin

func NewOrigin(_ context.Context, endpoint *url.URL) (Origin, error)

func (Origin) ValidateRequest

func (o Origin) ValidateRequest(request *http.Request) error

ValidateRequest checks both the destination URL and the authority sent on the wire, because Request.Host can override URL.Host without changing the URL.

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL