Documentation
¶
Overview ¶
Package middleware provides HTTP middleware for the server (auth, COP, logging).
Index ¶
- func AuthMiddleware(store *sessions.CookieStore, sessionManager session.SessionManager, ...) func(http.Handler) http.Handler
- func ConditionalMiddleware(next http.Handler) http.Handler
- func LoopbackOnly(next http.Handler) http.Handler
- func NewLoggingMiddleware(logger *slog.Logger) func(http.Handler) http.Handler
- type AuthConfig
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
func AuthMiddleware ¶
func AuthMiddleware(store *sessions.CookieStore, sessionManager session.SessionManager, config *AuthConfig) func(http.Handler) http.Handler
AuthMiddleware creates a middleware that protects routes by checking for a valid session. If the user is not authenticated, it returns 401 Unauthorized. It accepts a session store for checking authentication and a session manager for clearing sessions.
func ConditionalMiddleware ¶
ConditionalMiddleware handles If-None-Match and If-Modified-Since requests Returns 304 Not Modified if validators match, otherwise calls the next handler This middleware must be placed AFTER handlers that set validators (ETag, Last-Modified) For now, we'll let handlers execute and then check validators in a wrapper
func LoopbackOnly ¶ added in v0.11.0
LoopbackOnly returns a middleware that rejects any request whose RemoteAddr is not the loopback addresses 127.0.0.1 or ::1. Non-loopback requests receive a 404 Not Found response.
Host extraction uses security.RateLimitFromRequestKey for string-equality comparison (no IP normalization), ensuring RFC 4291 IPv4-mapped IPv6 addresses like ::ffff:127.0.0.1 are rejected.
Types ¶
type AuthConfig ¶
type AuthConfig struct {
// DebugDelayMS is an optional debug delay in milliseconds to add to requests.
// If IsSet is false or value is 0, no delay is added.
DebugDelayMS struct {
IsSet bool
Int int
}
}
AuthConfig holds configuration for auth middleware behavior.
Source Files