middleware

Documentation

Index

• Constants
• func CORS(config CORSConfig, logger logging.Logger) gin.HandlerFunc
• func CORSMiddleware(config CORSConfig, logger logging.Logger) gin.HandlerFunc
• func ContentSecurityPolicy(policy string) gin.HandlerFunc
• func ErrorHandler(logger logging.Logger) gin.HandlerFunc
• func GetRequestID(c *gin.Context) string
• func GetSanitizedParam(c *gin.Context, paramName string) string
• func InitCustomValidators(v *validator.Validate)
• func Logger(logger logging.Logger) gin.HandlerFunc
• func PreventClickjacking() gin.HandlerFunc
• func PreventMimeSniffing() gin.HandlerFunc
• func ProtectAgainstCSRF(logger logging.Logger) gin.HandlerFunc
• func RateLimiter(logger logging.Logger, cfg RateLimiterConfig) gin.HandlerFunc
• func Recovery(logger logging.Logger) gin.HandlerFunc
• func ReferrerPolicy(policy string) gin.HandlerFunc
• func RequestID() gin.HandlerFunc
• func RequestSizeLimiter(maxSize int64, logger logging.Logger) gin.HandlerFunc
• func SecureHeadersBundle() gin.HandlerFunc
• func Security(config SecurityConfig, logger logging.Logger) gin.HandlerFunc
• func ValidateAlphaNumericWithDash(fl validator.FieldLevel) bool
• func ValidateNoSQL(fl validator.FieldLevel) bool
• func ValidateNoScript(fl validator.FieldLevel) bool
• func Validation(logger logging.Logger) gin.HandlerFunc
• func XSSProtection() gin.HandlerFunc
• type AuthMiddleware
  • func NewAuthMiddleware(logger logging.Logger) AuthMiddleware
• type CORSConfig
  • func DefaultCORSConfig() CORSConfig
  • func ProductionCORSConfig(allowedOrigins []string) CORSConfig
• type ClientRateLimiter
• type RateLimiterConfig
• type SecurityConfig
  • func DefaultSecurityConfig() SecurityConfig
• type ValidationError

Constants

const (
	// RequestIDHeader is the header name for request IDs
	RequestIDHeader = "X-Request-ID"

	// RequestIDContextKey is the context key for request IDs
	RequestIDContextKey = "requestID"
)

Functions

func CORS

func CORS(config CORSConfig, logger logging.Logger) gin.HandlerFunc

CORS returns a middleware that handles CORS

func CORSMiddleware

func CORSMiddleware(config CORSConfig, logger logging.Logger) gin.HandlerFunc

CORSMiddleware creates a CORS middleware with the given configuration

func ContentSecurityPolicy

func ContentSecurityPolicy(policy string) gin.HandlerFunc

ContentSecurityPolicy adds CSP header to prevent various attacks

func ErrorHandler

func ErrorHandler(logger logging.Logger) gin.HandlerFunc

ErrorHandler middleware catches panics and errors

func GetRequestID

func GetRequestID(c *gin.Context) string

GetRequestID retrieves the request ID from the context

func GetSanitizedParam

func GetSanitizedParam(c *gin.Context, paramName string) string

GetSanitizedParam gets a sanitized path parameter value

func InitCustomValidators

func InitCustomValidators(v *validator.Validate)

InitCustomValidators initializes custom validators

func Logger

func Logger(logger logging.Logger) gin.HandlerFunc

Logger creates a middleware that logs HTTP requests

func PreventClickjacking

func PreventClickjacking() gin.HandlerFunc

PreventClickjacking adds X-Frame-Options header to prevent clickjacking

func PreventMimeSniffing

func PreventMimeSniffing() gin.HandlerFunc

PreventMimeSniffing adds X-Content-Type-Options header to prevent MIME sniffing

func ProtectAgainstCSRF

func ProtectAgainstCSRF(logger logging.Logger) gin.HandlerFunc

ProtectAgainstCSRF returns a middleware that protects against CSRF attacks

func RateLimiter

func RateLimiter(logger logging.Logger, cfg RateLimiterConfig) gin.HandlerFunc

RateLimiter middleware that limits request rate per client IP

func Recovery

func Recovery(logger logging.Logger) gin.HandlerFunc

Recovery creates a middleware that recovers from panics

func ReferrerPolicy

func ReferrerPolicy(policy string) gin.HandlerFunc

ReferrerPolicy controls what information is sent in the Referer header

func RequestID

func RequestID() gin.HandlerFunc

RequestID is a middleware that injects a request ID into the context

func RequestSizeLimiter

func RequestSizeLimiter(maxSize int64, logger logging.Logger) gin.HandlerFunc

RequestSizeLimiter limits the size of incoming requests

func SecureHeadersBundle

func SecureHeadersBundle() gin.HandlerFunc

SecureHeadersBundle adds all common security headers in one middleware

func Security

func Security(config SecurityConfig, logger logging.Logger) gin.HandlerFunc

Security returns a middleware that adds security headers

func ValidateAlphaNumericWithDash

func ValidateAlphaNumericWithDash(fl validator.FieldLevel) bool

ValidateAlphaNumericWithDash validates that a string contains only alphanumeric characters and dashes

func ValidateNoSQL

func ValidateNoSQL(fl validator.FieldLevel) bool

ValidateNoSQL validates that a string doesn't contain SQL injection attempts

func ValidateNoScript

func ValidateNoScript(fl validator.FieldLevel) bool

ValidateNoScript validates that a string doesn't contain script injection attempts

func Validation

func Validation(logger logging.Logger) gin.HandlerFunc

Validation middleware for request validation

func XSSProtection

func XSSProtection() gin.HandlerFunc

XSSProtection adds X-XSS-Protection header to prevent XSS attacks in older browsers

Types

type AuthMiddleware

type AuthMiddleware interface {
	// RequireAuth returns middleware that requires authentication
	RequireAuth() gin.HandlerFunc

	// RequireAdmin returns middleware that requires admin privileges
	RequireAdmin() gin.HandlerFunc

	// OptionalAuth returns middleware that makes authentication optional
	OptionalAuth() gin.HandlerFunc
}

AuthMiddleware defines the interface for authentication middleware

func NewAuthMiddleware

func NewAuthMiddleware(logger logging.Logger) AuthMiddleware

NewAuthMiddleware creates a new auth middleware instance

type CORSConfig

type CORSConfig struct {
	// AllowedOrigins is a list of origins that are allowed to make cross-domain requests
	AllowedOrigins []string

	// AllowedMethods is a list of methods that are allowed for cross-domain requests
	AllowedMethods []string

	// AllowedHeaders is a list of headers that are allowed for cross-domain requests
	AllowedHeaders []string

	// ExposedHeaders is a list of headers that are exposed to the client
	ExposedHeaders []string

	// AllowCredentials indicates whether the request can include user credentials
	AllowCredentials bool

	// MaxAge indicates how long the results of a preflight request can be cached
	MaxAge time.Duration
}

CORSConfig defines configuration for CORS middleware

func DefaultCORSConfig

func DefaultCORSConfig() CORSConfig

DefaultCORSConfig returns a default CORS configuration

func ProductionCORSConfig

func ProductionCORSConfig(allowedOrigins []string) CORSConfig

ProductionCORSConfig returns a stricter CORS configuration suitable for production

type ClientRateLimiter

type ClientRateLimiter struct {
	// contains filtered or unexported fields
}

ClientRateLimiter represents rate limiting configuration for a client

type RateLimiterConfig

type RateLimiterConfig struct {
	RequestsPerSecond int           // Number of requests allowed per second
	Burst             int           // Maximum burst size
	CleanupInterval   time.Duration // Interval to clean up old limiters
	ClientTimeout     time.Duration // Time after which a client is considered inactive
}

RateLimiterConfig defines configuration for rate limiting

type SecurityConfig

type SecurityConfig struct {
	// XSSProtection enables X-XSS-Protection header
	XSSProtection bool

	// ContentTypeNosniff enables X-Content-Type-Options header
	ContentTypeNosniff bool

	// XFrameOptions sets the X-Frame-Options header
	XFrameOptions string

	// ContentSecurityPolicy sets the Content-Security-Policy header
	ContentSecurityPolicy string

	// ReferrerPolicy sets the Referrer-Policy header
	ReferrerPolicy string

	// StrictTransportSecurity sets the Strict-Transport-Security header
	StrictTransportSecurity string

	// PermissionsPolicy sets the Permissions-Policy header
	PermissionsPolicy string
}

SecurityConfig defines configuration for security middleware

func DefaultSecurityConfig

func DefaultSecurityConfig() SecurityConfig

DefaultSecurityConfig returns a default security configuration

type ValidationError

type ValidationError struct {
	Field  string `json:"field"`
	Rule   string `json:"rule"`
	Value  string `json:"value,omitempty"`
	Reason string `json:"reason"`
}

ValidationError represents a validation error