security

func CORSMiddleware ¶

func CORSMiddleware() func(http.Handler) http.Handler

CORSMiddleware is a middleware that adds CORS headers to the response. Input Origin are mirrored back in the Access-Control-Allow-Origin header, allowing any origin to access the resource.

func CSRFCookie ¶ added in v1.3.0

func CSRFCookie(
	value string,
	sameSite http.SameSite,
	domain string,
) http.Cookie

CSRFCookie creates a new CSRF cookie with the given value, SameSite attribute, and domain.

func CSRFCookieString ¶ added in v1.3.0

func CSRFCookieString(
	value string,
	sameSite http.SameSite,
	domain string,
) string

CSRFCookieString creates a new CSRF cookie with the given value, SameSite attribute, and domain, and returns its string representation.

func CSRFMiddleware ¶

func CSRFMiddleware(next http.Handler) http.Handler

CSRFMiddleware is an HTTP middleware that checks for the presence of a valid CSRF token in requests. It should be used for all endpoints that modify state (e.g., POST, PUT, DELETE).

func CSRFMiddlewareWithExemptions ¶

func CSRFMiddlewareWithExemptions(exemptSuffixes []string) func(http.Handler) http.Handler

CSRFMiddlewareWithExemptions is an HTTP middleware that checks for the presence of a valid CSRF token in requests, with the ability to exempt certain request paths from CSRF protection.

func DenyAllOriginsMiddleware ¶ added in v1.3.0

func DenyAllOriginsMiddleware() func(http.Handler) http.Handler

func ExpiredRefreshCookie ¶ added in v1.3.0

func ExpiredRefreshCookie(
	sameSite http.SameSite,
	domain string,
	path string,
) http.Cookie

ExpiredRefreshCookie returns an http.Cookie struct representing an expired refresh cookie with the given SameSite attribute, domain, and path.

func ExpiredRefreshCookieString ¶ added in v1.3.0

func ExpiredRefreshCookieString(
	sameSite http.SameSite,
	domain string,
	path string,
) string

ExpiredRefreshCookieString returns a string representation of an expired refresh cookie with the given SameSite attribute, domain, and path.

func ExpiredSessionCookie ¶ added in v1.3.0

func ExpiredSessionCookie(
	sameSite http.SameSite,
	domain string,
) http.Cookie

ExpiredSessionCookie returns an http.Cookie struct representing an expired session cookie with the given SameSite attribute and domain.

func ExpiredSessionCookieString ¶ added in v1.3.0

func ExpiredSessionCookieString(
	sameSite http.SameSite,
	domain string,
) string

ExpiredSessionCookieString returns a string representation of an expired session cookie with the given SameSite attribute and domain.

func HasOrigin ¶ added in v1.3.0

func HasOrigin(r *http.Request) bool

HasOrigin checks if the request has an Origin header.

func RefreshCookie ¶ added in v1.3.0

func RefreshCookie(
	value string,
	sameSite http.SameSite,
	domain string,
	path string,
) http.Cookie

RefreshCookie returns an http.Cookie struct representing a refresh cookie with the given value, SameSite attribute, domain, and path.

func RefreshCookieString ¶ added in v1.3.0

func RefreshCookieString(
	value string,
	sameSite http.SameSite,
	domain string,
	path string,
) string

RefreshCookieString returns a string representation of a refresh cookie with the given value, SameSite attribute, domain, and path.

func SelectCORSMiddleware ¶ added in v1.3.0

func SelectCORSMiddleware(
	allowedOrigins []string,
	allowAll, denyAll bool,
) func(http.Handler) http.Handler

SelectCORSMiddleware selects the appropriate CORS middleware based on the provided configuration. If denyAll is true, it returns the DenyAllOriginsMiddleware that denies all origins. If allowAll is true, it returns the CORSMiddleware that allows all origins. If allowedOrigins is non-empty, it returns the WhitelistCORSMiddleware that allows only the specified origins. If neither condition is met, it returns a passthrough handler without any CORS validation.

func SessionCookie ¶ added in v1.3.0

func SessionCookie(
	value string,
	sameSite http.SameSite,
	domain string,
) http.Cookie

SessionCookie returns an http.Cookie struct representing a session cookie with the given value, SameSite attribute, and domain.

func SessionCookieString ¶ added in v1.3.0

func SessionCookieString(
	value string,
	sameSite http.SameSite,
	domain string,
) string

SessionCookieString returns a string representation of a session cookie with the given value, SameSite attribute, and domain.

func SetCORSHeaders ¶ added in v1.3.0

func SetCORSHeaders(w http.ResponseWriter, origin string)

SetCORSHeaders sets the necessary CORS headers on the response writer for the given origin.

func WhitelistCORSMiddleware ¶ added in v1.2.0

func WhitelistCORSMiddleware(allowedOrigins []string) func(http.Handler) http.Handler

WhitelistCORSMiddleware is a middleware that adds CORS headers to the response for requests from allowed origins. Non-whitelisted origins will receive a 403 Forbidden response.