Documentation
¶
Overview ¶
Package tokenorsession admits a request to a Go web API that carries either a bearer token goapiauth verifies or a gobrowserlogin session.
A command-line client sends the provider's access token. The API's own single-page front end sends the session cookie gobrowserlogin set, with its CSRF header. A request carrying a bearer credential is judged on it alone and never reaches the session, so a caller cannot pair a junk token with a stolen cookie.
Index ¶
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
func Require ¶
func Require(verifier goapiauth.TokenVerifier, sessions Sessions, log *slog.Logger, public ...string) func(http.Handler) http.Handler
Require passes a request to next when it carries a bearer token verifier accepts, or a session sessions authenticates, and puts the caller's goapiauth.Identity on its context. A session's Identity carries its Subject and Groups. A request for one of the public paths, or for goapiauth.ProtectedResourcePath, passes with neither: the browser login's routes are reached before a session exists.
A bearer request is answered as goapiauth.RequireBearer answers it, and every refusal carries one of goapiauth's codes. A request with no credential at all is a 401, a session cookie without the CSRF header is a 403, and a session store that cannot be read is a 503.
Source Files