Why Go
- Case Studies
  
  Common problems companies solve with Go
- Use Cases
  
  Stories about how and why companies use Go
- Security
  
  How Go can help keep you secure by default
Learn
Docs
- Effective Go
  
  Tips for writing clear, performant, and idiomatic Go code
- Go User Manual
  
  A complete introduction to building software with Go
- Standard library
  
  Reference documentation for Go's standard library
- Release Notes
  
  Learn what's new in each Go release
- API
  
  Reference documentation for the pkg.go.dev API
Packages
Community
- Recorded Talks
  
  Videos from prior events
- Meetups
  
  Meet other local Go developers
- Conferences
  
  Learn and network with Go developers from around the world
- Go blog
  
  The Go project's official blog.
- Go project
  
  Get help and stay informed from Go
- Get connected

middleware

package

Go to main page

Versions in this module

v5

v5.3.1

Jul 21, 2026

v5.3.0

Jul 12, 2026

v5.2.1

Jun 15, 2026

Changes in this version

type StaticConfig

+ EnablePathUnescaping bool

v5.2.0

Jun 14, 2026

Changes in this version

+ const HeaderXRateLimitLimit

+ const HeaderXRateLimitRemaining

type RateLimiterMemoryStore

+ func (store *RateLimiterMemoryStore) AllowContext(c *echo.Context, identifier string) (bool, error)

+ type RateLimiterStoreContext interface

+ AllowContext func(c *echo.Context, identifier string) (bool, error)

v5.1.1

May 1, 2026 GO-2026-6293

GO-2026-6293: Encoded slash (%2F) bypasses route-level protection and exposes static files in github.com/labstack/echo/v4 and github.com/labstack/echo/v5

v5.1.0

Mar 31, 2026 GO-2026-6293

GO-2026-6293: Encoded slash (%2F) bypasses route-level protection and exposes static files in github.com/labstack/echo/v4 and github.com/labstack/echo/v5

v5.0.4

Feb 15, 2026 GO-2026-6293

GO-2026-6293: Encoded slash (%2F) bypasses route-level protection and exposes static files in github.com/labstack/echo/v4 and github.com/labstack/echo/v5

Changes in this version

+ const CSRFUsingSecFetchSite

v5.0.3

Feb 6, 2026 GO-2026-6293

GO-2026-6293: Encoded slash (%2F) bypasses route-level protection and exposes static files in github.com/labstack/echo/v4 and github.com/labstack/echo/v5

v5.0.2

Feb 2, 2026 GO-2026-4502 +1 more

GO-2026-4502: Echo has a Windows path traversal via backslash in middleware.Static default filesystem in github.com/labstack/echo/v5

GO-2026-6293: Encoded slash (%2F) bypasses route-level protection and exposes static files in github.com/labstack/echo/v4 and github.com/labstack/echo/v5

v5.0.1

Jan 28, 2026 GO-2026-4502 +1 more

GO-2026-4502: Echo has a Windows path traversal via backslash in middleware.Static default filesystem in github.com/labstack/echo/v5

GO-2026-6293: Encoded slash (%2F) bypasses route-level protection and exposes static files in github.com/labstack/echo/v4 and github.com/labstack/echo/v5

Changes in this version

+ type PanicStackError struct

+ Err error

+ Stack []byte

+ func (e *PanicStackError) Error() string

+ func (e *PanicStackError) Unwrap() error

v5.0.0

Jan 18, 2026 GO-2026-4502 +1 more

GO-2026-4502: Echo has a Windows path traversal via backslash in middleware.Static default filesystem in github.com/labstack/echo/v5

GO-2026-6293: Encoded slash (%2F) bypasses route-level protection and exposes static files in github.com/labstack/echo/v4 and github.com/labstack/echo/v5

Changes in this version

+ const EB

+ const GB

+ const GZIPEncoding

+ const KB

+ const MB

+ const PB

+ const StatusCodeContextCanceled

+ const TB

+ var DefaultCSRFConfig = CSRFConfig

+ var DefaultKeyAuthConfig = KeyAuthConfig

+ var DefaultMethodOverrideConfig = MethodOverrideConfig

+ var DefaultProxyConfig = ProxyConfig

+ var DefaultRateLimiterConfig = RateLimiterConfig

+ var DefaultRateLimiterMemoryStoreConfig = RateLimiterMemoryStoreConfig

+ var DefaultRecoverConfig = RecoverConfig

+ var DefaultSecureConfig = SecureConfig

+ var DefaultStaticConfig = StaticConfig

+ var ErrCSRFInvalid = &echo.HTTPError

+ var ErrExtractorError = echo.NewHTTPError(http.StatusForbidden, "error while extracting identifier")

+ var ErrInvalidKey = echo.NewHTTPError(http.StatusUnauthorized, "invalid key")

+ var ErrKeyMissing = echo.NewHTTPError(http.StatusUnauthorized, "missing key")

+ var ErrRateLimitExceeded = echo.NewHTTPError(http.StatusTooManyRequests, "rate limit exceeded")

+ var RedirectHTTPSConfig = RedirectConfig

+ var RedirectHTTPSWWWConfig = RedirectConfig

+ var RedirectNonHTTPSWWWConfig = RedirectConfig

+ var RedirectNonWWWConfig = RedirectConfig

+ var RedirectWWWConfig = RedirectConfig

+ func AddTrailingSlash() echo.MiddlewareFunc

+ func AddTrailingSlashWithConfig(config AddTrailingSlashConfig) echo.MiddlewareFunc

+ func BasicAuth(fn BasicAuthValidator) echo.MiddlewareFunc

+ func BasicAuthWithConfig(config BasicAuthConfig) echo.MiddlewareFunc

+ func BodyDump(handler BodyDumpHandler) echo.MiddlewareFunc

+ func BodyDumpWithConfig(config BodyDumpConfig) echo.MiddlewareFunc

+ func BodyLimit(limitBytes int64) echo.MiddlewareFunc

+ func BodyLimitWithConfig(config BodyLimitConfig) echo.MiddlewareFunc

+ func CORS(allowOrigins ...string) echo.MiddlewareFunc

+ func CORSWithConfig(config CORSConfig) echo.MiddlewareFunc

+ func CSRF() echo.MiddlewareFunc

+ func CSRFWithConfig(config CSRFConfig) echo.MiddlewareFunc

+ func ContextTimeout(timeout time.Duration) echo.MiddlewareFunc

+ func ContextTimeoutWithConfig(config ContextTimeoutConfig) echo.MiddlewareFunc

+ func Decompress() echo.MiddlewareFunc

+ func DecompressWithConfig(config DecompressConfig) echo.MiddlewareFunc

+ func DefaultSkipper(c *echo.Context) bool

+ func Gzip() echo.MiddlewareFunc

+ func GzipWithConfig(config GzipConfig) echo.MiddlewareFunc

+ func HTTPSNonWWWRedirect() echo.MiddlewareFunc

+ func HTTPSNonWWWRedirectWithConfig(config RedirectConfig) echo.MiddlewareFunc

+ func HTTPSRedirect() echo.MiddlewareFunc

+ func HTTPSRedirectWithConfig(config RedirectConfig) echo.MiddlewareFunc

+ func HTTPSWWWRedirect() echo.MiddlewareFunc

+ func HTTPSWWWRedirectWithConfig(config RedirectConfig) echo.MiddlewareFunc

+ func KeyAuth(fn KeyAuthValidator) echo.MiddlewareFunc

+ func KeyAuthWithConfig(config KeyAuthConfig) echo.MiddlewareFunc

+ func MethodOverride() echo.MiddlewareFunc

+ func MethodOverrideWithConfig(config MethodOverrideConfig) echo.MiddlewareFunc

+ func NonWWWRedirect() echo.MiddlewareFunc

+ func NonWWWRedirectWithConfig(config RedirectConfig) echo.MiddlewareFunc

+ func Proxy(balancer ProxyBalancer) echo.MiddlewareFunc

+ func ProxyWithConfig(config ProxyConfig) echo.MiddlewareFunc

+ func RateLimiter(store RateLimiterStore) echo.MiddlewareFunc

+ func RateLimiterWithConfig(config RateLimiterConfig) echo.MiddlewareFunc

+ func Recover() echo.MiddlewareFunc

+ func RecoverWithConfig(config RecoverConfig) echo.MiddlewareFunc

+ func RemoveTrailingSlash() echo.MiddlewareFunc

+ func RemoveTrailingSlashWithConfig(config RemoveTrailingSlashConfig) echo.MiddlewareFunc

+ func RequestID() echo.MiddlewareFunc

+ func RequestIDWithConfig(config RequestIDConfig) echo.MiddlewareFunc

+ func RequestLogger() echo.MiddlewareFunc

+ func RequestLoggerWithConfig(config RequestLoggerConfig) echo.MiddlewareFunc

+ func Rewrite(rules map[string]string) echo.MiddlewareFunc

+ func RewriteWithConfig(config RewriteConfig) echo.MiddlewareFunc

+ func Secure() echo.MiddlewareFunc

+ func SecureWithConfig(config SecureConfig) echo.MiddlewareFunc

+ func Static(root string) echo.MiddlewareFunc

+ func StaticWithConfig(config StaticConfig) echo.MiddlewareFunc

+ func WWWRedirect() echo.MiddlewareFunc

+ func WWWRedirectWithConfig(config RedirectConfig) echo.MiddlewareFunc

+ type AddTrailingSlashConfig struct

+ RedirectCode int

+ Skipper Skipper

+ func (config AddTrailingSlashConfig) ToMiddleware() (echo.MiddlewareFunc, error)

+ type BasicAuthConfig struct

+ AllowedCheckLimit uint

+ Realm string

+ Skipper Skipper

+ Validator BasicAuthValidator

+ func (config BasicAuthConfig) ToMiddleware() (echo.MiddlewareFunc, error)

+ type BasicAuthValidator func(c *echo.Context, user string, password string) (bool, error)

+ type BeforeFunc func(c *echo.Context)

+ type BodyDumpConfig struct

+ Handler BodyDumpHandler

+ MaxRequestBytes int64

+ MaxResponseBytes int64

+ Skipper Skipper

+ func (config BodyDumpConfig) ToMiddleware() (echo.MiddlewareFunc, error)

+ type BodyDumpHandler func(c *echo.Context, reqBody []byte, resBody []byte, err error)

+ type BodyLimitConfig struct

+ LimitBytes int64

+ Skipper Skipper

+ func (config BodyLimitConfig) ToMiddleware() (echo.MiddlewareFunc, error)

+ type CORSConfig struct

+ AllowCredentials bool

+ AllowHeaders []string

+ AllowMethods []string

+ AllowOrigins []string

+ ExposeHeaders []string

+ MaxAge int

+ Skipper Skipper

+ UnsafeAllowOriginFunc func(c *echo.Context, origin string) (allowedOrigin string, allowed bool, err error)

+ func (config CORSConfig) ToMiddleware() (echo.MiddlewareFunc, error)

+ type CSRFConfig struct

+ AllowSecFetchSiteFunc func(c *echo.Context) (bool, error)

+ ContextKey string

+ CookieDomain string

+ CookieHTTPOnly bool

+ CookieMaxAge int

+ CookieName string

+ CookiePath string

+ CookieSameSite http.SameSite

+ CookieSecure bool

+ ErrorHandler func(c *echo.Context, err error) error

+ Generator func() string

+ Skipper Skipper

+ TokenLength uint8

+ TokenLookup string

+ TrustedOrigins []string

+ func (config CSRFConfig) ToMiddleware() (echo.MiddlewareFunc, error)

+ type ContextTimeoutConfig struct

+ ErrorHandler func(c *echo.Context, err error) error

+ Skipper Skipper

+ Timeout time.Duration

+ func (config ContextTimeoutConfig) ToMiddleware() (echo.MiddlewareFunc, error)

+ type DecompressConfig struct

+ GzipDecompressPool Decompressor

+ MaxDecompressedSize int64

+ Skipper Skipper

+ func (config DecompressConfig) ToMiddleware() (echo.MiddlewareFunc, error)

+ type Decompressor interface

+ type DefaultGzipDecompressPool struct

+ type Extractor func(c *echo.Context) (string, error)

+ type ExtractorSource string

+ const ExtractorSourceCookie

+ const ExtractorSourceForm

+ const ExtractorSourceHeader

+ const ExtractorSourcePathParam

+ const ExtractorSourceQuery

+ type GzipConfig struct

+ Level int

+ MinLength int

+ Skipper Skipper

+ func (config GzipConfig) ToMiddleware() (echo.MiddlewareFunc, error)

+ type KeyAuthConfig struct

+ AllowedCheckLimit uint

+ ContinueOnIgnoredError bool

+ ErrorHandler KeyAuthErrorHandler

+ KeyLookup string

+ Skipper Skipper

+ Validator KeyAuthValidator

+ func (config KeyAuthConfig) ToMiddleware() (echo.MiddlewareFunc, error)

+ type KeyAuthErrorHandler func(c *echo.Context, err error) error

+ type KeyAuthValidator func(c *echo.Context, key string, source ExtractorSource) (bool, error)

+ type MethodOverrideConfig struct

+ Getter MethodOverrideGetter

+ Skipper Skipper

+ func (config MethodOverrideConfig) ToMiddleware() (echo.MiddlewareFunc, error)

+ type MethodOverrideGetter func(c *echo.Context) string

+ func MethodFromForm(param string) MethodOverrideGetter

+ func MethodFromHeader(header string) MethodOverrideGetter

+ func MethodFromQuery(param string) MethodOverrideGetter

+ type ProxyBalancer interface

+ AddTarget func(target *ProxyTarget) bool

+ Next func(c *echo.Context) (*ProxyTarget, error)

+ RemoveTarget func(targetName string) bool

+ func NewRandomBalancer(targets []*ProxyTarget) ProxyBalancer

+ func NewRoundRobinBalancer(targets []*ProxyTarget) ProxyBalancer

+ type ProxyConfig struct

+ Balancer ProxyBalancer

+ ContextKey string

+ ErrorHandler func(c *echo.Context, err error) error

+ ModifyResponse func(*http.Response) error

+ RegexRewrite map[*regexp.Regexp]string

+ RetryCount int

+ RetryFilter func(c *echo.Context, e error) bool

+ Rewrite map[string]string

+ Skipper Skipper

+ Transport http.RoundTripper

+ func (config ProxyConfig) ToMiddleware() (echo.MiddlewareFunc, error)

+ type ProxyTarget struct

+ Meta map[string]any

+ Name string

+ URL *url.URL

+ type RateLimiterConfig struct

+ BeforeFunc BeforeFunc

+ DenyHandler func(c *echo.Context, identifier string, err error) error

+ ErrorHandler func(c *echo.Context, err error) error

+ IdentifierExtractor Extractor

+ Skipper Skipper

+ Store RateLimiterStore

+ func (config RateLimiterConfig) ToMiddleware() (echo.MiddlewareFunc, error)

+ type RateLimiterMemoryStore struct

+ func NewRateLimiterMemoryStore(rateLimit float64) (store *RateLimiterMemoryStore)

+ func NewRateLimiterMemoryStoreWithConfig(config RateLimiterMemoryStoreConfig) (store *RateLimiterMemoryStore)

+ func (store *RateLimiterMemoryStore) Allow(identifier string) (bool, error)

+ type RateLimiterMemoryStoreConfig struct

+ Burst int

+ ExpiresIn time.Duration

+ Rate float64

+ type RateLimiterStore interface

+ Allow func(identifier string) (bool, error)

+ type RecoverConfig struct

+ DisablePrintStack bool

+ DisableStackAll bool

+ Skipper Skipper

+ StackSize int

+ func (config RecoverConfig) ToMiddleware() (echo.MiddlewareFunc, error)

+ type RedirectConfig struct

+ Code int

+ func (config RedirectConfig) ToMiddleware() (echo.MiddlewareFunc, error)

+ type RemoveTrailingSlashConfig struct

+ RedirectCode int

+ Skipper Skipper

+ func (config RemoveTrailingSlashConfig) ToMiddleware() (echo.MiddlewareFunc, error)

+ type RequestIDConfig struct

+ Generator func() string

+ RequestIDHandler func(c *echo.Context, requestID string)

+ Skipper Skipper

+ TargetHeader string

+ func (config RequestIDConfig) ToMiddleware() (echo.MiddlewareFunc, error)

+ type RequestLoggerConfig struct

+ BeforeNextFunc func(c *echo.Context)

+ HandleError bool

+ LogContentLength bool

+ LogFormValues []string

+ LogHeaders []string

+ LogHost bool

+ LogLatency bool

+ LogMethod bool

+ LogProtocol bool

+ LogQueryParams []string

+ LogReferer bool

+ LogRemoteIP bool

+ LogRequestID bool

+ LogResponseSize bool

+ LogRoutePath bool

+ LogStatus bool

+ LogURI bool

+ LogURIPath bool

+ LogUserAgent bool

+ LogValuesFunc func(c *echo.Context, v RequestLoggerValues) error

+ Skipper Skipper

+ func (config RequestLoggerConfig) ToMiddleware() (echo.MiddlewareFunc, error)

+ type RequestLoggerValues struct

+ ContentLength string

+ Error error

+ FormValues map[string][]string

+ Headers map[string][]string

+ Host string

+ Latency time.Duration

+ Method string

+ Protocol string

+ QueryParams map[string][]string

+ Referer string

+ RemoteIP string

+ RequestID string

+ ResponseSize int64

+ RoutePath string

+ StartTime time.Time

+ Status int

+ URI string

+ URIPath string

+ UserAgent string

+ type RewriteConfig struct

+ RegexRules map[*regexp.Regexp]string

+ Rules map[string]string

+ Skipper Skipper

+ func (config RewriteConfig) ToMiddleware() (echo.MiddlewareFunc, error)

+ type SecureConfig struct

+ CSPReportOnly bool

+ ContentSecurityPolicy string

+ ContentTypeNosniff string

+ HSTSExcludeSubdomains bool

+ HSTSMaxAge int

+ HSTSPreloadEnabled bool

+ ReferrerPolicy string

+ Skipper Skipper

+ XFrameOptions string

+ XSSProtection string

+ func (config SecureConfig) ToMiddleware() (echo.MiddlewareFunc, error)

+ type Skipper func(c *echo.Context) bool

+ type StaticConfig struct

+ Browse bool

+ DirectoryListTemplate string

+ DisablePathUnescaping bool

+ Filesystem fs.FS

+ HTML5 bool

+ IgnoreBase bool

+ Index string

+ Root string

+ Skipper Skipper

+ func (config StaticConfig) ToMiddleware() (echo.MiddlewareFunc, error)

+ type ValueExtractorError struct

+ func (e *ValueExtractorError) Error() string

+ type ValuesExtractor func(c *echo.Context) ([]string, ExtractorSource, error)

+ func CreateExtractors(lookups string, limit uint) ([]ValuesExtractor, error)

+ type Visitor struct

Other modules containing this package

github.com/labstack/echo

github.com/labstack/echo/v4