httph

README

httph

HTTP helpers and middleware. H is for helpful!

Made in 🇩🇰 by maragu, maker of online Go courses.

Documentation

Overview

Package httph provides HTTP helpers and middleware compatible with net/http.

Index

• func FormHandler[Req any](h func(http.ResponseWriter, *http.Request, Req)) http.HandlerFunc
• func NoClickjacking(next http.Handler) http.Handler
• type ContentSecurityPolicyOptions
• type Middleware
  • func ContentSecurityPolicy(optsFunc func(opts *ContentSecurityPolicyOptions)) Middleware

Functions

func FormHandler

func FormHandler[Req any](h func(http.ResponseWriter, *http.Request, Req)) http.HandlerFunc

FormHandler takes a function that is like a regular http.Handler, except it also receives a struct with values parsed from http.Request.ParseForm. Any parsing errors will result in http.StatusBadRequest. Uses reflection under the hood. If the request struct satisfies the validator interface, also use it to validate the struct.

func NoClickjacking

func NoClickjacking(next http.Handler) http.Handler

NoClickjacking is Middleware which sets headers to disallow frame embedding and XSS protection for older browsers. See https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/X-Frame-Options See https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/X-XSS-Protection

Types

type ContentSecurityPolicyOptions

type ContentSecurityPolicyOptions struct {
	ChildSrc       string
	ConnectSrc     string
	DefaultSrc     string
	FontSrc        string
	FrameSrc       string
	ImgSrc         string
	ManifestSrc    string
	MediaSrc       string
	ObjectSrc      string
	ScriptSrc      string
	ScriptSrcElem  string
	ScriptSrcAttr  string
	StyleSrc       string
	StyleSrcElem   string
	StyleSrcAttr   string
	WorkerSrc      string
	BaseURI        string
	Sandbox        string
	FormAction     string
	FrameAncestors string
	ReportTo       string
}

ContentSecurityPolicyOptions for the ContentSecurityPolicy Middleware. The field names match policy directives, and only values should be supplied, so no directive names and delimiters. Only non-experimental, non-deprecated directives are included. See https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy

type Middleware

type Middleware = func(next http.Handler) http.Handler

Middleware is a function that takes an http.Handler and returns an http.Handler. This is a common middleware pattern in net/http.

func ContentSecurityPolicy

func ContentSecurityPolicy(optsFunc func(opts *ContentSecurityPolicyOptions)) Middleware

ContentSecurityPolicy is Middleware to set CSP headers. By default this is a strict policy, disallowing everything but images, styles, scripts, and fonts from 'self'. See https://developer.mozilla.org/en-US/docs/Web/HTTP/CSP See https://infosec.mozilla.org/guidelines/web_security#content-security-policy