Documentation
¶
Overview ¶
Package middleware provides HTTP middleware for the PeeringDB Plus server.
Index ¶
- func CORS(in CORSInput) func(http.Handler) http.Handler
- func CSP(in CSPInput) func(http.Handler) http.Handler
- func Caching(in CachingInput) func(http.Handler) http.Handler
- func Compression() func(http.Handler) http.Handler
- func Logging(logger *slog.Logger) func(http.Handler) http.Handler
- func Recovery(logger *slog.Logger) func(http.Handler) http.Handler
- type CORSInput
- type CSPInput
- type CachingInput
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
func CORS ¶
CORS returns middleware that adds CORS headers per OPS-06. Origins are configured via the AllowedOrigins field.
func CSP ¶ added in v1.12.0
CSP returns middleware that sets a Content-Security-Policy-Report-Only header based on the request path. Web UI routes get a tighter policy; GraphQL gets a more permissive policy for the GraphiQL playground. Non-browser routes (/api/, /rest/, ConnectRPC) receive no CSP header.
Report-Only mode reports violations without blocking resources, allowing safe rollout and monitoring before switching to enforcing mode.
func Caching ¶ added in v1.9.0
func Caching(in CachingInput) func(http.Handler) http.Handler
Caching returns middleware that sets Cache-Control and ETag headers on GET/HEAD responses, and returns 304 Not Modified for conditional requests when data has not changed since the last sync.
Only GET and HEAD methods receive caching headers. POST and other mutation methods pass through unchanged. If no successful sync has occurred (zero sync time), no caching headers are set.
func Compression ¶ added in v1.12.0
Compression returns middleware that gzip-compresses HTTP responses when the client advertises Accept-Encoding: gzip. gRPC content types are excluded because ConnectRPC manages its own compression.
Uses klauspost/compress/gzhttp which handles Content-Encoding headers, ETag suffixing (appends --gzip), and minimum size thresholds automatically.
Types ¶
type CORSInput ¶
type CORSInput struct {
// AllowedOrigins is a comma-separated list of allowed origins. Use "*" for all origins.
AllowedOrigins string
}
CORSInput holds configuration for the CORS middleware.
type CSPInput ¶ added in v1.12.0
type CSPInput struct {
// UIPolicy is the CSP directive string applied to /ui/ routes.
UIPolicy string
// GraphQLPolicy is the CSP directive string applied to /graphql routes.
// Typically more permissive than UIPolicy (e.g. allows unsafe-eval for GraphiQL).
GraphQLPolicy string
}
CSPInput holds configuration for the Content-Security-Policy middleware.
type CachingInput ¶ added in v1.9.0
type CachingInput struct {
// SyncTimeFn returns the last successful sync completion time.
// Returns zero time if no successful sync has occurred.
SyncTimeFn func() time.Time
// SyncInterval is the configured duration between automatic sync runs.
// Used to calculate Cache-Control max-age (interval + 120s buffer).
SyncInterval time.Duration
}
CachingInput holds configuration for the HTTP caching middleware.
Source Files