authware

May 6, 2026

Changes in this version

+ func CSRF(opts CSRFOptions) (func(http.Handler) http.Handler, error)

+ func MaxBytes(maxBytes int64) func(http.Handler) http.Handler

+ func NewRedactor(inner slog.Handler, keys ...string) slog.Handler

+ func RedactHeader(h http.Header, keys ...string) http.Header

+ func RequireCapability(checks ...Capability) func(http.Handler) http.Handler

+ func SecurityHeaders(cfg *SecureHeadersConfig) func(http.Handler) http.Handler

+ func SensitiveHeaders() []string

+ type CSRFOptions struct

+ BypassPaths []string

+ DenyHandler http.Handler

+ TrustedOrigins []string

+ type Capability func(*Identity) bool

+ func HasAllScopes(scopes ...string) Capability

+ func HasAnyScope(scopes ...string) Capability

+ func HasClaim(name string, value any) Capability

+ func HasMethod(m Mode) Capability

+ func HasScope(scope string) Capability

+ func HasSubject(subject string) Capability

type Config

+ MTLSAllowedSPKIPins [][]byte

+ MTLSAllowedSubjects []string

+ OAuthClockSkewTolerance time.Duration

+ OAuthHTTPClient *http.Client

+ OAuthJWKSCacheTTL time.Duration

+ OAuthProxyFetchTimeout time.Duration

+ SecureCSRFTrusted []string

+ SecureHeaders SecureHeadersConfig

+ SecureMaxRequestBytes int64

type Identity

+ PeerCert *x509.Certificate

+ func (id *Identity) Claim(name string) (any, bool)

+ func (id *Identity) ClaimBool(name string) (value, ok bool)

+ func (id *Identity) ClaimFloat64(name string) (float64, bool)

+ func (id *Identity) ClaimInt64(name string) (int64, bool)

+ func (id *Identity) ClaimString(name string) (string, bool)

+ func (id *Identity) RangeClaims(fn func(name string, value any) bool) bool

+ type Mode string

+ const ModeMTLS

+ type SecureHeadersConfig struct

+ CSP string

+ ContentTypeNosniff bool

+ FrameOptions string

+ HSTSIncludeSubs bool

+ HSTSMaxAge int

+ HSTSPreload bool

+ PermissionsPolicy string

+ ReferrerPolicy string

+ XSSProtection string

Apr 15, 2026

Changes in this version

type Config

+ OAuthClientSecret string

Apr 14, 2026

Changes in this version

type OAuthProxy

+ func (p *OAuthProxy) AuthorizeHandler() http.HandlerFunc

Apr 14, 2026

Changes in this version

type Config

+ OAuthClientID string

+ type OAuthProxy struct

+ func NewOAuthProxy(cfg *Config, log *slog.Logger) *OAuthProxy

+ func (p *OAuthProxy) ASMetadataHandler() http.HandlerFunc

+ func (p *OAuthProxy) RegisterHandler() http.HandlerFunc

+ func (p *OAuthProxy) TokenHandler() http.HandlerFunc

Apr 14, 2026

Changes in this version

+ const ModeAPIKey

+ const ModeBearer

+ const ModeNone

+ const ModeOAuth

+ func AuthCheckHandler(auth Authenticator) http.Handler

+ func Middleware(auth Authenticator) func(http.Handler) http.Handler

+ func RequireScopes(scopes ...string) func(http.Handler) http.Handler

+ func WithIdentity(ctx context.Context, id Identity) context.Context

+ type Authenticator interface

+ Authenticate func(r *http.Request) (Identity, error)

+ Challenge func(err error, resourceMetadataURL string) (status int, header string, message string)

+ Metadata func(resource string) *ProtectedResourceMetadata

+ func New(cfg *Config, client *http.Client) (Authenticator, error)

+ type Config struct

+ APIKey string

+ APIKeyHeader string

+ BearerToken string

+ Mode string

+ OAuthAudience string

+ OAuthAuthorizationServers []string

+ OAuthHMACSecret string

+ OAuthIssuer string

+ OAuthJWKSURL string

+ OAuthRequiredScopes []string

+ OAuthResource string

+ OAuthResourceDocumentation string

+ OAuthResourceName string

+ Realm string

+ func ConfigFromEnv() *Config

+ type Identity struct

+ Method string

+ Scopes string

+ Subject string

+ func IdentityFromContext(ctx context.Context) (Identity, bool)

+ type ProtectedResourceMetadata struct

+ AuthorizationServers []string

+ BearerMethodsSupported []string

+ Resource string

+ ResourceDocumentation string

+ ResourceName string

+ ScopesSupported []string