middleware

package

v0.24.0 Latest Latest Go to latest Published: Oct 11, 2026 License: MIT Imports: 23 Imported by: 0

Details

Valid go.mod file
Redistributable license
Tagged version
Stable version
Learn more about best practices

Repository

github.com/authara-org/authara

Links

Open Source Insights

Documentation ¶

Index ¶

Variables
func HTMXMiddleware(next http.Handler) http.Handler
func LimitRequestBody(maxBytes int64) func(http.Handler) http.Handler
func OptionalAccessIdentity(sessionSvc *session.Service, audience token.Audience, now func() time.Time) func(http.Handler) http.Handler
func RedirectIfAuthenticated(sessionService *session.Service, now func() time.Time) func(http.Handler) http.Handler
func RequestLogger(logger *slog.Logger) func(http.Handler) http.Handler
func RequireAPIAccessAuth(sessionSvc *session.Service, audience token.Audience, now func() time.Time) func(http.Handler) http.Handler
func RequireAPICSRF(next http.Handler) http.Handler
func RequireAccessAuthWithRefresh(sessionSvc *session.Service, audience token.Audience, accessTTL time.Duration, ...) func(http.Handler) http.Handler
func RequireAccessAuthWithRefreshPolicy(sessionSvc *session.Service, audience token.Audience, ...) func(http.Handler) http.Handler
func RequireAdmin(next http.Handler) http.Handler
func RequireAllowlistEnabled(enabled bool) func(http.Handler) http.Handler
func RequireAllowlistEnabledWithPolicy(policy config.AllowlistPolicyReader) func(http.Handler) http.Handler
func RequireCSRF(next http.Handler) http.Handler
func RequireChallengeEnabled(enabled bool) func(http.Handler) http.Handler
func RequireInternalAPIAuth(token string) func(http.Handler) http.Handler
func RequireOperator(next http.Handler) http.Handler
func RequirePublicOrganizationManagement(enabled bool) func(http.Handler) http.Handler
func RequirePublicOrganizationManagementWithPolicy(policy config.OrganizationPolicyReader) func(http.Handler) http.Handler
func RequireRecentAuthenticationAPI(sessionService *session.Service, now func() time.Time) func(http.Handler) http.Handler
func RequireRecentAuthenticationUI(sessionService *session.Service, now func() time.Time) func(http.Handler) http.Handler
func RequireVerifiedEmailAPI(service emailVerificationStarter, policy config.AuthenticationPolicyReader, ...) func(http.Handler) http.Handler
func RequireVerifiedEmailUI(service emailVerificationStarter, policy config.AuthenticationPolicyReader, ...) func(http.Handler) http.Handler
func ReturnTo(next http.Handler) http.Handler
func ReturnToWithDefault(defaultReturnTo string) func(http.Handler) http.Handler
func ReturnToWithPolicy(policy config.UIPolicyReader) func(http.Handler) http.Handler
func SecurityHeaders(cfg SecurityHeadersConfig) func(http.Handler) http.Handler
func TrustedRealIP(trustedProxies []netip.Prefix) func(http.Handler) http.Handler
type SecurityHeadersConfig

Constants ¶

This section is empty.

Variables ¶

View Source

var (
	ErrCSRFCookieMissing = errors.New("csrf cookie token missing")
	ErrCSRFTokenMissing  = errors.New("csrf token missing in request")
	ErrCSRFTokenInvalid  = errors.New("csrf token invalid")
)

Functions ¶

func HTMXMiddleware ¶ added in v0.1.12

func HTMXMiddleware(next http.Handler) http.Handler

func LimitRequestBody ¶ added in v0.20.0

func LimitRequestBody(maxBytes int64) func(http.Handler) http.Handler

func OptionalAccessIdentity ¶ added in v0.1.16

func OptionalAccessIdentity(
	sessionSvc *session.Service,
	audience token.Audience,
	now func() time.Time,
) func(http.Handler) http.Handler

func RedirectIfAuthenticated ¶

func RedirectIfAuthenticated(sessionService *session.Service, now func() time.Time) func(http.Handler) http.Handler

func RequestLogger ¶

func RequestLogger(logger *slog.Logger) func(http.Handler) http.Handler

func RequireAPIAccessAuth ¶

func RequireAPIAccessAuth(sessionSvc *session.Service, audience token.Audience, now func() time.Time) func(http.Handler) http.Handler

func RequireAPICSRF ¶

func RequireAPICSRF(next http.Handler) http.Handler

func RequireAccessAuthWithRefresh ¶

func RequireAccessAuthWithRefresh(
	sessionSvc *session.Service,
	audience token.Audience,
	accessTTL time.Duration,
	refreshTTL time.Duration,
	now func() time.Time,
) func(http.Handler) http.Handler

RequirePageAccessAuthWithRefresh protects Authara-rendered pages + HTMX actions. It validates the access token, and if it's missing/expired it will try to refresh using the refresh token cookie. If refresh fails, it redirects to login.

func RequireAccessAuthWithRefreshPolicy ¶ added in v0.21.0

func RequireAccessAuthWithRefreshPolicy(
	sessionSvc *session.Service,
	audience token.Audience,
	policy config.SessionCookiePolicyReader,
	now func() time.Time,
) func(http.Handler) http.Handler

func RequireAdmin ¶

func RequireAdmin(next http.Handler) http.Handler

func RequireAllowlistEnabled ¶ added in v0.1.23

func RequireAllowlistEnabled(enabled bool) func(http.Handler) http.Handler

func RequireAllowlistEnabledWithPolicy ¶ added in v0.21.0

func RequireAllowlistEnabledWithPolicy(policy config.AllowlistPolicyReader) func(http.Handler) http.Handler

func RequireCSRF ¶

func RequireCSRF(next http.Handler) http.Handler

func RequireChallengeEnabled ¶ added in v0.1.14

func RequireChallengeEnabled(enabled bool) func(http.Handler) http.Handler

func RequireInternalAPIAuth ¶ added in v0.1.24

func RequireInternalAPIAuth(token string) func(http.Handler) http.Handler

func RequireOperator ¶ added in v0.20.0

func RequireOperator(next http.Handler) http.Handler

RequireOperator allows only identities with the exact operator platform role. Other privileged roles do not imply operator access.

func RequirePublicOrganizationManagement ¶ added in v0.1.27

func RequirePublicOrganizationManagement(enabled bool) func(http.Handler) http.Handler

func RequirePublicOrganizationManagementWithPolicy ¶ added in v0.21.0

func RequirePublicOrganizationManagementWithPolicy(policy config.OrganizationPolicyReader) func(http.Handler) http.Handler

func RequireRecentAuthenticationAPI ¶ added in v0.22.0

func RequireRecentAuthenticationAPI(sessionService *session.Service, now func() time.Time) func(http.Handler) http.Handler

func RequireRecentAuthenticationUI ¶ added in v0.22.0

func RequireRecentAuthenticationUI(sessionService *session.Service, now func() time.Time) func(http.Handler) http.Handler

func RequireVerifiedEmailAPI ¶ added in v0.22.0

func RequireVerifiedEmailAPI(
	service emailVerificationStarter,
	policy config.AuthenticationPolicyReader,
	audience token.Audience,
	now func() time.Time,
) func(http.Handler) http.Handler

func RequireVerifiedEmailUI ¶ added in v0.22.0

func RequireVerifiedEmailUI(
	service emailVerificationStarter,
	policy config.AuthenticationPolicyReader,
	audience token.Audience,
	now func() time.Time,
) func(http.Handler) http.Handler

func ReturnTo ¶

func ReturnTo(next http.Handler) http.Handler

func ReturnToWithDefault ¶ added in v0.10.0

func ReturnToWithDefault(defaultReturnTo string) func(http.Handler) http.Handler

func ReturnToWithPolicy ¶ added in v0.21.0

func ReturnToWithPolicy(policy config.UIPolicyReader) func(http.Handler) http.Handler

func SecurityHeaders ¶ added in v0.1.23

func SecurityHeaders(cfg SecurityHeadersConfig) func(http.Handler) http.Handler

func TrustedRealIP ¶ added in v0.22.0

func TrustedRealIP(trustedProxies []netip.Prefix) func(http.Handler) http.Handler

TrustedRealIP resolves a client address from forwarding headers only when the request's transport peer belongs to a configured trusted proxy network.

Types ¶

type SecurityHeadersConfig ¶ added in v0.1.23

type SecurityHeadersConfig struct {
	AllowGoogleOAuth    bool
	AllowAppleOAuth     bool
	AllowMicrosoftOAuth bool
	AllowShowcase       bool
}

?	: This menu
/	: Search site
f or F	: Jump to
y or Y	: Canonical URL