middleware/

Package abtest provides middleware that assigns each visitor a stable A/B test bucket and persists the assignment in a cookie so a returning visitor stays in the same bucket across requests.

Package acceptlanguage provides middleware that parses the Accept-Language request header, optionally negotiates it against a set of supported languages, and stores the chosen language tag on the request under the key "language".

Package accesslog provides middleware that writes an Apache "combined" style access log line for every request once it completes.

Package apikey provides middleware that authenticates requests using an API key supplied via a request header or query-string parameter.

Package basepath provides middleware that strips a fixed prefix from the request path, allowing an application mounted under a sub-path (for example behind a reverse proxy at "/app") to be written as though it were served from root.

Package basicauth provides HTTP Basic authentication middleware for the express framework.

Package bearerauth provides middleware that authenticates requests using an opaque bearer token supplied in the Authorization header.

Package bodylimit provides express middleware that rejects requests whose body exceeds a configured size, guarding handlers against oversized uploads.

Package cachecontrol provides express middleware that sets a Cache-Control header assembled from a set of caching options.

Package circuitbreaker provides middleware implementing the circuit-breaker pattern.

Package compression provides express middleware that gzip-compresses response bodies for clients that advertise gzip support via the Accept-Encoding request header.

Package concurrencylimit provides express middleware that caps the number of requests processed concurrently and sheds load once that cap is reached.

Package contenttypedefault provides express middleware that sets a fallback Content-Type on the response when a downstream handler does not set one itself.

Package cookieparser provides express middleware that parses every cookie from the incoming request into a map[string]string and stores it on the request for convenient downstream access.

Package cookiesession implements a lightweight, cookie-only session store as express middleware.

Package correlationid provides express middleware that assigns a correlation id to every request so that a single logical operation can be traced as it fans out across multiple services and log streams.

Package cors provides configurable Cross-Origin Resource Sharing (CORS) middleware for the express framework.

Package crossoriginembedder provides express middleware that sets the Cross-Origin-Embedder-Policy (COEP) response header on every response.

Package crossoriginopener provides express middleware that sets the Cross-Origin-Opener-Policy (COOP) response header on every response.

Package crossoriginresource provides express middleware that sets the Cross-Origin-Resource-Policy (CORP) response header on every response.

Package csp provides middleware that builds and sets a Content-Security-Policy response header from a directive map.

Package cspnonce provides middleware that generates a fresh, cryptographically random nonce for every request and emits a Content-Security-Policy header whose script-src directive includes that nonce, enabling specific inline scripts to be allow-listed safely.

Package csrf provides Cross-Site Request Forgery protection using the double-submit-cookie pattern.

Package decompress provides express middleware that transparently decompresses gzip-encoded request bodies so downstream handlers read plain data.

Package dnsprefetch provides middleware that sets the X-DNS-Prefetch-Control response header, controlling whether browsers speculatively resolve the DNS names of links and resources on a page.

Package downloadheader provides express middleware that marks responses as file downloads by setting the Content-Disposition response header to "attachment".

Package errorjson provides an express error-handling middleware that renders unhandled errors as a JSON object of the form {"error": "<message>"}.

Package etag provides express middleware that computes a strong ETag for the response body and answers conditional requests with 304 Not Modified.

Package expectct provides express middleware that sets the Expect-CT response header, allowing sites to opt in to reporting and/or enforcement of Certificate Transparency requirements.

Package expires provides express middleware that sets an HTTP Expires header a fixed duration into the future.

Package favicon provides express middleware that answers requests for /favicon.ico, short-circuiting them before they reach application routes or logging.

Package featureflag provides middleware that attaches a fixed set of boolean feature flags to every request, letting downstream handlers gate behavior on named features.

Package flash implements one-time "flash" messages backed by the express session.

Package forcessl provides middleware that redirects insecure HTTP requests to their HTTPS equivalent, preserving the host, path, and query string.

Package frameguard provides middleware that sets the X-Frame-Options response header to control whether the page may be rendered inside a <frame>, <iframe>, <embed>, or <object>, helping to mitigate clickjacking attacks.

Package healthcheck provides a liveness/readiness endpoint for the express framework.

Package healthz provides a minimal liveness endpoint.

Package helmet bundles a sensible set of security-related HTTP response headers into a single express middleware, mirroring the popular Node.js Helmet defaults.

Package hidepoweredby provides middleware that removes the X-Powered-By response header (or replaces it with a decoy value) so the server does not advertise the technology stack it runs on.

Package hmacauth provides middleware that authenticates requests by verifying an HMAC-SHA256 signature of the request body against a shared secret.

Package hostcheck provides middleware that guards against Host header attacks by permitting only requests whose hostname is in a configured allowlist.

Package hsts provides middleware that sets the HTTP Strict-Transport-Security (HSTS) response header, instructing conforming browsers to access the site only over HTTPS.

Package ienoopen provides middleware that sets the X-Download-Options response header to the single value "noopen".

Package ipallowlist provides middleware that only permits requests whose client IP address matches a configured allowlist of exact addresses or CIDR ranges, rejecting everything else with 403 Forbidden.

Package ipblocklist provides middleware that rejects requests whose client IP address matches a configured blocklist of exact addresses or CIDR ranges, responding with 403 Forbidden, and lets every other request through.

Package jsonp provides Express middleware that wraps JSON responses in a JavaScript callback invocation when the request carries a callback query parameter, enabling classic cross-origin JSONP requests.

Package jwtauth provides Express middleware that verifies HS256-signed JSON Web Tokens supplied via the Authorization header, gating access to protected routes.

Package latencyheader provides middleware that measures how long a request takes to process and records the elapsed milliseconds in a response header (X-Response-Latency by default).

Package maintenance provides middleware that puts an application into maintenance mode.

Package methodallow provides middleware that restricts requests to a configured set of HTTP methods, responding with 405 Method Not Allowed otherwise.

Package methodoverride provides middleware that overrides the HTTP request method using either a request header or a query-string parameter.

Package metrics provides middleware that records basic request metrics for the express framework: the total number of requests and a breakdown by status class (2xx, 3xx, 4xx, 5xx).

Package nocache provides express middleware that instructs clients and proxies never to cache the response.

Package nonce provides middleware that generates a fresh, random, base64-encoded nonce for each request.

Package nosniff provides middleware that sets the response header X-Content-Type-Options: nosniff on every request.

Package notfound provides a terminal handler that responds with 404 Not Found for requests that fall through the router unmatched.

Package originagentcluster provides middleware that sets the Origin-Agent-Cluster response header on every response, requesting that the browser place the origin into its own, origin-keyed agent cluster.

Package origincheck provides middleware that rejects requests whose Origin header is not in a configured allowlist, mitigating cross-site request forgery (CSRF) and other cross-origin abuse from untrusted callers.

Package pagination provides middleware that parses the common "page" and "limit" query-string parameters into a normalized, bounds-checked Pagination value stored on the request.

Package panicjson provides middleware that recovers from panics raised by downstream handlers, logs them, and responds with a generic 500 JSON error so that a single failing request cannot crash the process.

Package permittedcrossdomain provides middleware that sets the X-Permitted-Cross-Domain-Policies response header on every response, controlling whether Adobe clients honor cross-domain policy files served by the site.

Package poweredby provides express middleware that sets the X-Powered-By response header to a configurable value.

Package querylimit provides middleware that rejects requests whose raw query string exceeds a configured maximum length.

Package querynormalize provides middleware that normalizes the request query string: it lower-cases parameter keys, trims surrounding whitespace from values, and rebuilds the raw query in a deterministic (key-sorted) order.

Package ratelimit provides a fixed-window, per-client rate limiter for the express framework.

Package rawbody provides express middleware that reads the entire request body into memory, stores it on the request via SetBody, and restores req.Raw.Body so downstream handlers can read it again.

Package readiness provides a readiness-probe endpoint for the express framework.

Package realip provides middleware that determines the true client IP address from the X-Forwarded-For and X-Real-IP headers, taking an optional list of trusted proxies into account, and rewrites req.Raw.RemoteAddr to the resolved value.

Package redirectmap provides middleware that redirects requests whose path matches an entry in a static lookup table.

Package referer provides middleware that captures the Referer request header, parses out its host, and stores the result on the request under the key "referer" for downstream handlers such as analytics and anti-CSRF checks.

Package referercheck provides middleware that rejects requests whose Referer header host is not in a configured allowlist.

Package referrerpolicy provides middleware that sets the Referrer-Policy response header, controlling how much referrer information the browser attaches to outgoing requests originated from your pages.

Package requestcontext provides middleware that attaches a small request-scoped context to each request: a unique request ID and a start timestamp.

Package requestcounter provides middleware that maintains a per-process sequential counter of the total number of requests handled.

Package requestdump provides development middleware that records a snapshot of each incoming request (method, path, headers, and capture time) into a bounded, thread-safe ring buffer for later inspection.

Package requestid provides express middleware that assigns each request a unique identifier, echoes it on the response, and stores it on the request for downstream handlers and logging.

Package requireauth provides middleware that rejects requests unless an authenticated principal has already been placed on the request by an earlier middleware.

Package responsecache provides simple in-memory caching of successful GET responses.

Package responsetime provides express middleware that measures how long a request takes to process and reports it in an X-Response-Time header.

Package retryafter provides middleware that automatically attaches a Retry-After header to responses whose status indicates the client should back off (429 Too Many Requests and 503 Service Unavailable by default).

Package rewrite provides URL-rewriting middleware.

Package rolecheck provides middleware that authorizes a request only when the caller holds at least one of a configured set of roles.

Package sanitize provides middleware that strips HTML tags from every query-string value on the incoming request, mitigating trivial reflected cross-site-scripting (XSS) vectors that flow through query parameters.

Package scopecheck provides middleware that authorizes a request only when the caller holds every one of a configured set of scopes.

Package serveindex provides middleware that renders an HTML directory listing for requests that resolve to a directory beneath a configured root.

Package servertiming provides express middleware that collects timing metrics during request handling and emits them in a Server-Timing response header, which browsers surface in their developer tools' network panel.

Package signedcookies provides middleware that verifies a tamper-evident, HMAC-signed cookie and exposes its plaintext value to downstream handlers.

Package slowdown provides middleware that progressively delays responses for a client once it exceeds a configured request threshold within a fixed window.

Package slowlog provides middleware that logs a warning whenever a request takes longer than a configured threshold to complete, helping surface slow endpoints.

Package spa provides middleware for serving single-page applications.

Package subdomain provides middleware that extracts the subdomain portion of the request's hostname and stores it on the request for downstream handlers under the key "subdomain".

Package throttle provides a per-client token-bucket rate limiter for the express framework.

Package timeout provides middleware that bounds the time a downstream handler chain may take before the client is answered.

Package tokenheader provides generic middleware that validates an opaque token carried in a single, configurable request header.

Package trailingslash provides middleware that enforces a consistent trailing-slash policy on request paths by redirecting requests that do not conform.

Package uptime provides middleware that reports how long the middleware -- and, by extension, the process serving requests -- has been running.

Package useragent provides middleware that performs lightweight parsing of the User-Agent request header into a small struct and stores it on the request for downstream handlers.

Package useragentblock provides middleware that rejects requests whose User-Agent header contains any configured blocked substring.

Package vary provides express middleware that appends fields to the response Vary header, signalling which request headers a cached response depends on.

Package version provides middleware that exposes an application's version.

Package vhost provides virtual-host middleware that dispatches requests to a dedicated handler based on the request's hostname.

Package xssfilter provides express middleware that sets the legacy X-XSS-Protection response header on every response.