Affected by 
Documentation
¶
Index ¶
- Constants
- Variables
- func AuthRequired() gin.HandlerFunc
- func AuthRequiredWS() gin.HandlerFunc
- func CORS() gin.HandlerFunc
- func CacheJs() gin.HandlerFunc
- func CheckWebSocketOrigin(r *http.Request) bool
- func DemoReadOnly() gin.HandlerFunc
- func EncryptedForm() gin.HandlerFunc
- func EncryptedParams() gin.HandlerFunc
- func EnsureSecureSessionCookie(c *gin.Context)
- func IPWhiteList() gin.HandlerFunc
- func Proxy() gin.HandlerFunc
- func ProxyWs() gin.HandlerFunc
- func RejectInDemo() gin.HandlerFunc
- func RequireInteractiveUser() gin.HandlerFunc
- func RequireSecureSession() gin.HandlerFunc
- func SecureSessionCookie() gin.HandlerFunc
- func ServeStatic() gin.HandlerFunc
- func SetupAuthRequired() gin.HandlerFunc
- type ServerFileSystemType
Constants ¶
const SecureSessionCookieName = "_nginx_ui_secure_session"
const SecureSessionVerifiedKey = "SecureSessionVerified"
Variables ¶
var ( ErrInvalidRequestFormat = e.New(40000, "invalid request format") ErrDecryptionFailed = e.New(40001, "decryption failed") ErrFormParseFailed = e.New(40002, "form parse failed") ErrDisabledInDemo = e.New(40300, "this action is disabled in demo mode") )
Functions ¶
func AuthRequired ¶
func AuthRequired() gin.HandlerFunc
AuthRequired is a middleware that checks if the user is authenticated
func AuthRequiredWS ¶
func AuthRequiredWS() gin.HandlerFunc
AuthRequiredWS is a WebSocket-specific auth middleware that does NOT read cookies. This prevents CSWSH attacks by requiring explicit token passing via header or query param.
func CORS ¶
func CORS() gin.HandlerFunc
func CacheJs ¶
func CacheJs() gin.HandlerFunc
CacheJs is a middleware that send header to client to cache js file
func CheckWebSocketOrigin ¶
CheckWebSocketOrigin validates browser origins for WebSocket upgrade requests. Authenticated node-to-node traffic is always allowed, regardless of the Origin header, because proxied requests carry the browser's original Origin which won't match the downstream node's host.
func DemoReadOnly ¶
func DemoReadOnly() gin.HandlerFunc
DemoReadOnly blocks state-changing methods in demo mode while leaving reads intact. Use it on cosy CRUD groups where the listing is worth showing but the writes are not worth accepting.
func EncryptedForm ¶
func EncryptedForm() gin.HandlerFunc
EncryptedForm handles multipart/form-data with encrypted fields while preserving file uploads
func EncryptedParams ¶
func EncryptedParams() gin.HandlerFunc
func EnsureSecureSessionCookie ¶
EnsureSecureSessionCookie makes sure the session-binding cookie exists.
func IPWhiteList ¶
func IPWhiteList() gin.HandlerFunc
func Proxy ¶
func Proxy() gin.HandlerFunc
func ProxyWs ¶
func ProxyWs() gin.HandlerFunc
func RejectInDemo ¶
func RejectInDemo() gin.HandlerFunc
RejectInDemo blocks a route outright when the node runs in demo mode.
It is meant for routes whose side effects escape the container: ACME issuance against a real CA, backup upload to object storage, outbound webhooks, process restart, and settings writes that could redirect any of the above. Local CRUD (sites, streams, configs) is deliberately left open, because the demo container runs on ephemeral disk and restores itself.
Note this is not redundant with RequireSecureSession: that middleware is a pass-through for users with no OTP, 2FA or passkey, and demo mode refuses TOTP enrollment, so the demo user can never trigger it.
func RequireInteractiveUser ¶
func RequireInteractiveUser() gin.HandlerFunc
RequireInteractiveUser prevents a verified node principal from invoking controller-administration APIs intended only for a logged-in administrator.
func RequireSecureSession ¶
func RequireSecureSession() gin.HandlerFunc
func SecureSessionCookie ¶
func SecureSessionCookie() gin.HandlerFunc
SecureSessionCookie sets an HttpOnly SameSite=Lax cookie when serving the SPA. This cookie acts as a CSRF-proof session binding for the short token endpoint.
func ServeStatic ¶
func ServeStatic() gin.HandlerFunc
func SetupAuthRequired ¶
func SetupAuthRequired() gin.HandlerFunc
SetupAuthRequired authorizes first-run setup requests with the one-time install secret.
Types ¶
type ServerFileSystemType ¶
type ServerFileSystemType struct {
http.FileSystem
}
Source Files