Documentation
¶
Overview ¶
Package ephttp is the HTTP surface of endpoints (#2174): every request to /endpoints/{name}/... and the bot check a bot_check one is answered behind (/botcheck/challenge and /botcheck/solver.js).
An authenticated endpoint answers a platform API key or a browser session its callers list names, and the identity the platform found is what the handler reads as req.caller; it never comes from the request body. A public endpoint answers anyone. A bot_check endpoint answers a request carrying an answer to the bot check it names in the X-Bot-Check header, or one with none to a method it does not check (#2259).
These routes answer their own cross-origin requests from each binding's allowed origins; the platform's CORS layer leaves them alone. No limit here depends on the client's address, which a request behind an ingress and a load balancer does not carry.
Index ¶
Constants ¶
const ( // PathPrefix is every endpoint's prefix; a request's path is // /endpoints/{name} and what follows it. PathPrefix = "/endpoints/" // BotCheckPrefix is the bot check's routes. BotCheckPrefix = "/botcheck/" )
The routes.
const HeaderBotCheck = "X-Bot-Check"
HeaderBotCheck carries a public request's bot check answer.
Variables ¶
var ErrForbidden = errors.New("the request's credential was refused")
ErrForbidden is what Authenticate returns for a credential that was presented and refused for a reason other than its absence (a browser session without its CSRF token), which is answered 403 rather than 401.
Functions ¶
This section is empty.
Types ¶
type Checker ¶
type Checker interface {
Issue(ctx context.Context, check, endpoint string) (botcheck.Challenge, error)
Verify(ctx context.Context, check, endpoint, answer string) error
}
Checker issues and verifies the named bot checks.
type Handler ¶
type Handler struct {
Runner Runner
Checker Checker
// Authenticate is who sent the request: a browser session or an API key,
// with the persona its roles resolve to and the key's name.
// Nil caller and nil error is nobody.
Authenticate func(r *http.Request) (*eprun.Caller, error)
// Refused counts a request refused before its handler ran, by endpoint
// and reason (#2208). Nil counts nothing.
Refused func(endpointID, reason string)
// ViewerKey opens the viewer token an authenticated form embedded in an
// asset is sent with (epform.ViewerKey, #2177); nil honors none.
ViewerKey []byte
// contains filtered or unexported fields
}
Handler answers the routes.
Source Files