requestid

Overview ¶

Package requestid mints and checks the correlation ID a request carries.

None of it touches a request. Both middleware chains read the header on their own transport and hand the string here, so the rule for what may be echoed back is one rule rather than two — which matters more than it sounds, because the rule is a security check: an ID arrives from the client and leaves in a response header, and a second copy of the check would be a second chance to get the escaping wrong.