Documentation
¶
Overview ¶
Package httpauth centralizes the bearer credential contract shared by the local HTTP plane (internal/http) and the server plane (internal/platform/server). It depends only on the standard library so either composition can import it without crossing the architecture gate.
Index ¶
Constants ¶
const ( // DigestSize is the fixed SHA-256 width every secret comparison is reduced // to before the constant-time compare. DigestSize = sha256.Size )
Variables ¶
This section is empty.
Functions ¶
func CompareDigest ¶
func CompareDigest(a, b [DigestSize]byte) bool
CompareDigest compares two fixed-width digests in constant time. The operand width is a compile-time constant, so neither the cost nor the result depends on the raw lengths that produced the digests.
func EqualSecret ¶
EqualSecret reports whether the presented secret matches the configured one. Both sides are hashed to a fixed 32-byte digest first, closing the length oracle of comparing raw bytes with subtle.ConstantTimeCompare.
func ExtractSecret ¶
ExtractSecret returns the presented secret for the request. It recognizes the case-sensitive ASCII "Bearer " Authorization scheme and, when opts.AcceptAPIKey is set, the X-API-Key header as a fallback. A blank or absent candidate yields ok == false. The returned secret is normalized only as opts.Trim dictates, so byte-exact callers observe the header value unchanged.
func SecretDigest ¶
func SecretDigest(secret string) [DigestSize]byte
SecretDigest reduces a secret to its fixed-width SHA-256 digest.
func WriteUnauthorized ¶
func WriteUnauthorized(w http.ResponseWriter)
WriteUnauthorized emits the canonical 401 both planes converge on: the WWW-Authenticate challenge plus the nested error envelope the embedded web client parses.
Types ¶
type Options ¶
type Options struct {
// AcceptAPIKey enables the X-API-Key header as a bearer-equivalent source.
AcceptAPIKey bool
// Trim trims surrounding whitespace from the Authorization header before
// scheme matching and from the extracted secret.
Trim bool
}
Options selects a plane's bearer extraction policy.
func LocalOptions ¶
func LocalOptions() Options
LocalOptions mirrors internal/http.withAuth today: whitespace-tolerant and accepting both Authorization: Bearer and X-API-Key.
func ServerOptions ¶
func ServerOptions() Options
ServerOptions mirrors platform/server requestAuthenticator today: the secret is byte-exact and only the Authorization: Bearer scheme is consulted.
Source Files