httpauth

Oct 16, 2026

Changes in this version

type CSRFMiddleware

+ Secret []byte

+ SessionID func(*http.Request) string

+ TrustedOrigins []string

Oct 16, 2026

Changes in this version

+ const MaxFormBodySize

+ func CapRequestBody(w http.ResponseWriter, r *http.Request)

Oct 16, 2026

Changes in this version

+ func DenyFraming(w http.ResponseWriter)

+ func LocalRedirect(target, fallback string) string

type OneAuth

+ InsecureCookies bool

May 26, 2026

Changes in this version

type Middleware

+ SubjectParamName string

+ func (a *Middleware) GetLoggedInSubject(r *http.Request) string

type OneAuth

+ func (a *OneAuth) SetLoggedInSubject(subject string, w http.ResponseWriter, r *http.Request) string

May 26, 2026

Changes in this version

type OneAuth

+ func (a *OneAuth) SetLoggedInUserID(userID string, w http.ResponseWriter, r *http.Request) string

Apr 9, 2026

Changes in this version

type SecurityHeadersConfig

+ CrossOriginEmbedderPolicy string

+ CrossOriginOpenerPolicy string

+ CrossOriginResourcePolicy string

Apr 2, 2026

Changes in this version

+ func SecurityHeaders() func(http.Handler) http.Handler

+ func SecurityHeadersWithConfig(cfg SecurityHeadersConfig) func(http.Handler) http.Handler

+ type SecurityHeadersConfig struct

+ ContentSecurityPolicy string

+ FrameOptions string

+ HSTSIncludeSubDomains bool

+ HSTSMaxAge int

+ PermissionsPolicy string

+ ReferrerPolicy string

+ func DefaultSecurityHeadersConfig() SecurityHeadersConfig

Apr 2, 2026

Changes in this version

+ const DefaultMaxBodySize

+ func IsBodyTooLargeError(err error) bool

+ func LimitBody(maxBytes int64) func(http.Handler) http.Handler

+ func LimitBodyReader(w http.ResponseWriter, r *http.Request, maxBytes int64)

Mar 18, 2026

Changes in this version

+ func CSRFTemplateField(r *http.Request) template.HTML

+ func CSRFToken(r *http.Request) string

+ type AuthUserStore interface

+ EnsureAuthUser func(authtype string, provider string, token *oauth2.Token, userInfo map[string]any) (core.User, error)

+ type CSRFMiddleware struct

+ CookieName string

+ ErrorHandler http.HandlerFunc

+ ExemptFunc func(*http.Request) bool

+ FieldName string

+ HeaderName string

+ MaxAge int

+ Path string

+ SameSite http.SameSite

+ Secure bool

+ func (m *CSRFMiddleware) Protect(next http.Handler) http.Handler

+ type LinkOAuthConfig struct

+ ChannelStore core.ChannelStore

+ IdentityStore core.IdentityStore

+ UserStore core.UserStore

+ type Middleware struct

+ AuthTokenCookieName string

+ AuthTokenHeaderName string

+ CallbackURLParam string

+ DefaultRedirectURL string

+ GetRedirURL func(r *http.Request) string

+ SessionGetter func(r *http.Request, param string) any

+ UserParamName string

+ VerifyToken func(tokenString string) (loggedInUserId string, token any, err error)

+ func (a *Middleware) EnsureReasonableDefaults()

+ func (a *Middleware) EnsureUser(next http.Handler) http.Handler

+ func (a *Middleware) ExtractUser(next http.Handler) http.Handler

+ func (a *Middleware) GetLoggedInUserId(r *http.Request) string

+ type OneAuth struct

+ AppName string

+ AuthTokenSessionVar string

+ CookieDomains []string

+ JWTSecretKey string

+ JwtIssuer string

+ Middleware Middleware

+ Session *scs.SessionManager

+ SessionTimeoutInSeconds int

+ UserStore AuthUserStore

+ func New(appName string) *OneAuth

+ func (a *OneAuth) AddAuth(prefix string, handler http.Handler) *OneAuth

+ func (a *OneAuth) EnsureDefaults() *OneAuth

+ func (a *OneAuth) GetLinkingUserID(r *http.Request) string

+ func (a *OneAuth) HandleLinkOAuthCallback(config LinkOAuthConfig, linkingUserID, provider string, ...)

+ func (a *OneAuth) Handler() http.Handler

+ func (a *OneAuth) SaveUserAndRedirect(authtype, provider string, token *oauth2.Token, userInfo map[string]any, ...)

+ func (a *OneAuth) StartLinkOAuth(r *http.Request, userID string)