middleware

func AdminAuthMiddleware ¶ added in v1.0.0

func AdminAuthMiddleware(next http.Handler) http.Handler

AdminAuthMiddleware verifies that the request has a valid JWT token with an admin role. Used to protect admin-only endpoints.

func AuthAudienceMiddleware ¶ added in v1.0.0

func AuthAudienceMiddleware(next http.Handler) http.Handler

AuthAudienceMiddleware checks that the JWT token has the correct audience (aud claim)

func CORSMiddleware ¶

func CORSMiddleware(next http.Handler) http.Handler

CORSMiddleware handles CORS based on the cors_allowed_origins runtime setting. When no origins are configured CORS headers are omitted entirely. A wildcard "*" origin sends Access-Control-Allow-Origin: *. Specific origins are reflected with Vary and Access-Control-Allow-Credentials.

func CSRFMiddleware ¶

func CSRFMiddleware(next http.Handler) http.Handler

func CombineMiddlewares ¶

func CombineMiddlewares(middlewares []func(http.Handler) http.Handler) func(http.Handler) http.Handler

func GetRequestID ¶ added in v1.1.2

func GetRequestID(ctx context.Context) string

GetRequestID retrieves the request ID from the context. Returns an empty string if no request ID is present.

func LoggingMiddleware ¶

func LoggingMiddleware(next http.Handler) http.Handler

func RateLimitMiddleware ¶ added in v1.0.8

func RateLimitMiddleware(store *ratelimit.Store) func(http.Handler) http.Handler

RateLimitMiddleware returns a middleware that enforces per-IP rate limiting using the provided Store. Requests that exceed the limit receive a 429 with a Retry-After: 1 header and an OAuth-style JSON error body.

func RequestIDMiddleware ¶ added in v1.1.2

func RequestIDMiddleware(next http.Handler) http.Handler

RequestIDMiddleware generates a unique request ID for each request, injects it into the context, and sets it on the X-Request-ID response header.

func SecurityHeadersMiddleware ¶ added in v1.6.2

func SecurityHeadersMiddleware(next http.Handler) http.Handler

SecurityHeadersMiddleware adds defense-in-depth HTTP headers recommended by OWASP. These prevent clickjacking, MIME sniffing, and restrict embedding.