sessionlabel

package
v1.6.0 Latest Latest
Warning

This package is not in the latest version of its module.

 Go to latest Published: Aug 14, 2026 License: MIT Imports: 13 Imported by: 0

Documentation

Overview

Package sessionlabel provides a framework-neutral trusted edge adapter for pseudonymising an application session before nginx writes access logs.

Index

Constants

View Source 
const (
	HeaderName                = "X-Isutools-Session"
	ScenarioHeaderName        = "X-Isutools-Scenario"
	TrustedSessionHeaderName  = "X-Isutools-Trusted-Session"
	TrustedScenarioHeaderName = "X-Isutools-Trusted-Scenario"
	EnvGlobalMode             = "ISUTOOLS"
	EnvFlowLabels             = "ISUTOOLS_FLOW_LABELS"
	EnvSourceCookie           = "ISUTOOLS_SESSION_COOKIE"
	EnvHMACKey                = "ISUTOOLS_SESSION_HMAC_KEY"
	EnvScenario               = "ISUTOOLS_SCENARIO"
	EnvTrustInbound           = "ISUTOOLS_TRUST_INBOUND_FLOW_LABELS"
	MinKeyBytes               = 32
	LabelBytes                = 18
	MaxSourceBytes            = 4096
	MaxScenarioBytes          = 64
	MaxTrustedSessionBytes    = 128
)

Variables

This section is empty.

Functions

func Scenario added in v1.6.0 

func Scenario(scenario string) func(http.Handler) http.Handler

Scenario returns framework-neutral middleware for assigning one explicit scenario to a route or route group.

func SetScenario added in v1.6.0 

func SetScenario(r *http.Request, scenario string) bool

SetScenario assigns a bounded, non-secret scenario to the current request. It succeeds only when the request is inside Adapter.Middleware. Invalid labels clear any static fallback so a bad value cannot be misclassified.

Types

type Adapter 

type Adapter struct {
	// contains filtered or unexported fields
}

Adapter is immutable and safe for concurrent requests.

func FromEnv 

func FromEnv(getenv func(string) string) *Adapter

FromEnv resolves the adapter without retaining the getenv callback.

func New 

func New(cookieName string, key []byte) *Adapter

New validates the source cookie and HMAC key. Invalid configuration is a fail-closed adapter that strips spoofed labels but emits no replacement.

func (*Adapter) Health 

func (a *Adapter) Health() Health

func (*Adapter) Label 

func (a *Adapter) Label(source string) (string, bool)

Label returns a fixed-length URL-safe pseudonym. False means fail closed.

func (*Adapter) Middleware 

func (a *Adapter) Middleware(next http.Handler) http.Handler

Middleware always removes an untrusted client label. When the configured source cookie is present, it writes only its pseudonym to the trusted upstream response header consumed by nginx.

func (*Adapter) WithObserver added in v1.6.0 

func (a *Adapter) WithObserver(observer Observer) *Adapter

WithObserver returns a shallow copy with one run-aligned flow sink.

type Health 

type Health struct {
	Enabled bool   `json:"enabled"`
	Reason  string `json:"reason"`
}

Health is bounded configuration state. It never includes a cookie, key, or raw environment value.

type Observer added in v1.6.0 

type Observer interface {
	Observe(session, scenario, method, route string)
}

Observer receives only the HMAC pseudonym, bounded scenario, method, and registered route template after the application handler completes.

Source Files

View all Source files

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL
go.dev uses cookies from Google to deliver and enhance the quality of its services and to analyze traffic. Learn more.