Documentation
¶
Overview ¶
Package claims provides the canonical 3-header identity contract for every Base-derived service. There is exactly ONE way to read the authenticated caller's identity: FromHeaders.
The Hanzo Gateway validates the IAM JWT upstream and re-emits exactly three headers on the forwarded request. Services MUST NOT read any other variant (no X-Hanzo-*, no X-IAM-*, no singular X-User-Role, no X-Tenant-Id alias):
X-User-Id <- JWT "sub" X-Org-Id <- JWT "owner" X-Roles <- JWT "roles" (comma-joined if array)
Services MUST call StripIdentityHeaders on every inbound request before the JWT middleware re-injects trusted values. A client that sets any of these headers directly is rejected at the gateway; services defend in depth by stripping again locally in case a sidecar/mesh bypasses the gateway.
Index ¶
Constants ¶
const ( HeaderUserID = "X-User-Id" HeaderOrgID = "X-Org-Id" HeaderRoles = "X-Roles" )
The canonical 3 identity headers. These are the ONLY headers a handler may read to determine the authenticated principal.
Variables ¶
This section is empty.
Functions ¶
func Strip ¶
Strip is a net/http middleware that calls StripIdentityHeaders on every inbound request before delegating to next. Use at the outermost layer of a service, before any JWT middleware that populates the canonical 3 headers.
func StripIdentityHeaders ¶
StripIdentityHeaders removes every inbound identity-bearing header from h. Call this before JWT validation re-injects the canonical values. It also unconditionally drops every header whose name starts with "X-Hanzo-" or "X-IAM-" (case-insensitive), closing the "clever-new-prefix" attack vector.
Types ¶
type Claims ¶
Claims is the verified identity of the current request as asserted by the upstream gateway's JWT validation. All three fields may be empty strings / empty slices when the request is unauthenticated (public endpoints).
func FromHeaders ¶
FromHeaders returns the canonical Claims for the request. It reads ONLY the three canonical headers; any legacy variant set by a client is ignored by design (and should have been stripped upstream).
Roles are decoded from a comma-separated list; empty roles are dropped.
Source Files