authorization

func CSRFProtector ¶

func CSRFProtector(allowedOrigins []string) func(http.Handler) http.Handler

CSRFProtector adds a CSRF protection middleware to the chain if the program is not running in development mode.

func CSRFTokenHeader ¶

func CSRFTokenHeader(w http.ResponseWriter, r *http.Request)

CSRFTokenHeader writes masked CSRF token in a HTTP response header.

func ServerAuthorizer ¶

func ServerAuthorizer(tc *tls.Config, allowedOrigins []string) func(http.Handler) http.Handler

ServerAuthorizer uses two models to authorize incoming requests:

• if the request comes from a trusted client authenticated using mutual TLS, it is authorized.
• if the request comes from a web browser (directly or via a single-page application), it is authorized only if it meets CORS middleware prerequisites (which depend on the development mode setting and the configuration of the application).
• if none of the above methods authorized the request, it is denied.