Why Go
- Case Studies
  
  Common problems companies solve with Go
- Use Cases
  
  Stories about how and why companies use Go
- Security
  
  How Go can help keep you secure by default
Learn
Docs
- Effective Go
  
  Tips for writing clear, performant, and idiomatic Go code
- Go User Manual
  
  A complete introduction to building software with Go
- Standard library
  
  Reference documentation for Go's standard library
- Release Notes
  
  Learn what's new in each Go release
- API
  
  Reference documentation for the pkg.go.dev API
Packages
Community
- Recorded Talks
  
  Videos from prior events
- Meetups
  
  Meet other local Go developers
- Conferences
  
  Learn and network with Go developers from around the world
- Go blog
  
  The Go project's official blog.
- Go project
  
  Get help and stay informed from Go
- Get connected

authithttp

package

Go to main page

Versions in this module

v0

v0.7.0

Oct 19, 2026

Changes in this version

+ const DefaultCSRFCookieName

+ const DefaultCSRFField

+ const DefaultCSRFHeader

+ const DefaultReturnToParam

+ const DefaultSessionCookieName

+ var ErrCSRFToken = errors.New("authit/http: missing or mismatched CSRF token")

+ var ErrCrossOrigin = errors.New("authit/http: cross-origin request refused")

+ func CSRFProtect(opts CSRFOptions) (func(http.Handler) http.Handler, error)

+ func CSRFToken(r *http.Request) string

+ func ClaimsFrom(ctx context.Context) (authitjwt.Claims, bool)

+ func ClearSessionCookie(w http.ResponseWriter, r *http.Request, opts SessionCookieOptions) error

+ func ContextWithClaims(ctx context.Context, claims authitjwt.Claims) context.Context

+ func SafeReturnTo(target, fallback string) string

+ func SessionCookie(r *http.Request, opts SessionCookieOptions) (string, bool)

+ func SessionMiddleware(v SessionValidator, opts SessionOptions) (func(http.Handler) http.Handler, error)

+ func SetSessionCookie(w http.ResponseWriter, r *http.Request, token string, ...) error

+ type CSRFOptions struct

+ AllowMissingOrigin bool

+ DoubleSubmit bool

+ ErrorHandler func(w http.ResponseWriter, r *http.Request, err error)

+ TokenCookie SessionCookieOptions

+ TokenField string

+ TokenHeader string

+ TrustedOrigins []string

+ type SessionCookieOptions struct

+ AllowHTTP bool

+ Domain string

+ MaxAge time.Duration

+ Name string

+ Path string

+ SameSite http.SameSite

+ TrustForwardedProto bool

+ type SessionOptions struct

+ Cookie SessionCookieOptions

+ ErrorHandler func(w http.ResponseWriter, r *http.Request, status int, err error)

+ IsAPIRequest func(*http.Request) bool

+ Optional bool

+ ReturnToParam string

+ SignInURL string

v0.6.0

Oct 19, 2026

v0.5.0

Oct 19, 2026

v0.4.0

Oct 19, 2026

Changes in this version

+ const DefaultRefreshCookieName

+ var ErrCookiePathRequired = errors.New("authit/http: cookie Path is required")

+ var ErrCookiePrefix = errors.New("authit/http: cookie name prefix conflicts with its attributes")

+ var ErrCookieValue = errors.New("authit/http: token is not a valid cookie value")

+ func ClearRefreshCookie(w http.ResponseWriter, opts CookieOptions) error

+ func RefreshCookie(r *http.Request, opts CookieOptions) (string, bool)

+ func SetRefreshCookie(w http.ResponseWriter, token string, opts CookieOptions) error

+ type Authenticator interface

+ Authenticate func(ctx context.Context, r *http.Request) (authitjwt.Claims, error)

+ func SessionAuth(v SessionValidator) Authenticator

+ func VerifierAuth(v authitjwt.Verifier) Authenticator

+ type AuthenticatorFunc func(ctx context.Context, r *http.Request) (authitjwt.Claims, error)

+ func (f AuthenticatorFunc) Authenticate(ctx context.Context, r *http.Request) (authitjwt.Claims, error)

+ type CookieOptions struct

+ Domain string

+ Insecure bool

+ MaxAge time.Duration

+ Name string

+ Path string

+ SameSite http.SameSite

+ type SessionValidator interface

+ ValidateSession func(ctx context.Context, token string) (authitjwt.Claims, error)

v0.3.0

Aug 26, 2026

Changes in this version

+ var ErrInvalidToken = errors.New("authit/http: invalid bearer token")

+ var ErrNoToken = errors.New("authit/http: no bearer token")

+ func BearerToken(r *http.Request) (string, bool)

+ func StatusFor(err error) int

+ func Validate(s authitjwt.Signer, r *http.Request) (authitjwt.Claims, error)

v0.2.0

Aug 25, 2026