Documentation
¶
Overview ¶
Package authhttp holds the HTTP rules the remote server and the console share: problem responses, JSON bodies, identity error mapping, session cookies, CSRF, authentication admission and deployment probes.
Index ¶
- Constants
- func DecodeJSON(w http.ResponseWriter, r *http.Request, target any) bool
- func IdentityError(w http.ResponseWriter, err error)
- func Probes(database Pinger, next http.Handler) http.Handler
- func Problem(w http.ResponseWriter, status int, detail string)
- func SetSession(w http.ResponseWriter, secret string, expiry time.Time, insecure bool)
- func Unauthorized(w http.ResponseWriter)
- func Unsafe(method string) bool
- func ValidCSRF(r *http.Request, expected string) bool
- func WriteJSON(w http.ResponseWriter, status int, value any)
- type Admission
- type Attempts
- type Pinger
Constants ¶
const (
AttemptLimit = 20
)
Each client IP may make AttemptLimit authentication attempts per window, which starts at its first attempt.
const SessionCookie = "diffx_session"
SessionCookie names the browser session cookie on each origin.
Variables ¶
This section is empty.
Functions ¶
func DecodeJSON ¶
func IdentityError ¶
func IdentityError(w http.ResponseWriter, err error)
IdentityError maps identity outcomes to problem responses.
func Probes ¶
Probes answers unauthenticated deployment probes before identity: /healthz reports a serving process without touching the database, and /readyz also requires a database that accepts queries. Neither explains a failure.
func SetSession ¶
SetSession writes the session cookie, or clears it for an empty secret.
func Unauthorized ¶
func Unauthorized(w http.ResponseWriter)
Types ¶
type Admission ¶
type Admission struct {
// contains filtered or unexported fields
}
Admission bounds authentication attempts: a few at once per process and, with a client IP header, a fixed number per client IP each window. The listener's peer is an ingress, not the client, so the IP comes only from the header a trusted ingress sets; without that header attempts are not limited per client.
Source Files