Documentation
¶
Overview ¶
Package security provides the response-headers and rate-limiting middleware every generated backend mounts.
Index ¶
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
func Headers ¶
func Headers(cfg HeadersConfig) echo.MiddlewareFunc
Headers returns middleware that sets the baseline security headers on every response.
func IPExtractor ¶
func IPExtractor(trustedProxies []string) (echo.IPExtractor, error)
IPExtractor returns the extractor Echo uses for RealIP. With no trustedProxies it reads the TCP peer only; otherwise X-Forwarded-For is honoured through peers inside the given CIDRs. It errors on a CIDR it cannot parse or on a catch-all range, which would let every client pick its own address.
func RateLimit ¶
func RateLimit(cfg RateLimitConfig) echo.MiddlewareFunc
RateLimit returns middleware that answers 429 once a client exceeds cfg. A client is the IPv4 address or the IPv6 /64 the Echo instance's IPExtractor resolves, or the TCP peer when none is set. Limits are per process; replicas do not share a bucket.
Types ¶
type HeadersConfig ¶
type HeadersConfig struct {
// HSTS adds Strict-Transport-Security. Leave it off wherever the
// server is reached over plain http.
HSTS bool
// SkipCSP lists request paths that receive no Content-Security-Policy.
SkipCSP []string
}
HeadersConfig controls what Headers emits.
type RateLimitConfig ¶
type RateLimitConfig struct {
// RPS is the sustained requests per second allowed per client IP.
RPS float64
// Burst is how many requests a client may make at once before RPS applies.
Burst int
// SkipPaths lists request paths the limiter never counts.
SkipPaths []string
}
RateLimitConfig controls what RateLimit allows.
Source Files