goji / httpauth

HTTP Authentication middlewares

Goji

Goji is a HTTP request multiplexer, similar to net/http.ServeMux. It compares incoming requests to a list of registered Patterns, and dispatches to the http.Handler that corresponds to the first matching Pattern. Goji also supports Middleware (composable shared functionality applied to every request) and uses the standard context package to store request-scoped values.

Quick Start

package main

import (
        "fmt"
        "net/http"

        "goji.io"
        "goji.io/pat"
)

func hello(w http.ResponseWriter, r *http.Request) {
        name := pat.Param(r, "name")
        fmt.Fprintf(w, "Hello, %s!", name)
}

func main() {
        mux := goji.NewMux()
        mux.HandleFunc(pat.Get("/hello/:name"), hello)

        http.ListenAndServe("localhost:8000", mux)
}

Please refer to Goji's GoDoc Documentation for a full API reference.

Stability

Goji's API was recently updated to use the new net/http and context integration, and is therefore some of its interfaces are in a state of flux. We don't expect any further changes to the API, and expect to be able to announce API stability soon. Goji is suitable for use in production.

Prior to Go 1.7, Goji promised API stability with a different API to the one that is offered today. The author broke this promise, and does not take this breach of trust lightly. While stability is obviously extremely important, the author and community have decided to follow the broader Go community in standardizing on the standard library copy of the context package.

Users of the old API can find that familiar API on the net-context branch. The author promises to maintain both the net-context branch and master for the forseeable future.

Community / Contributing

Goji maintains a mailing list, gojiberries, where you should feel welcome to ask questions about the project (no matter how simple!), to announce projects or libraries built on top of Goji, or to talk about Goji more generally. Goji's author (Carl Jackson) also loves to hear from users directly at his personal email address, which is available on his GitHub profile page.

Contributions to Goji are welcome, however please be advised that due to Goji's stability guarantees interface changes are unlikely to be accepted.

All interactions in the Goji community will be held to the high standard of the broader Go community's Code of Conduct.

httpauth's Issues

How to use this with cji package?

I've been trying to set up this middleware with the cji package with no luck. Any hints?

Add request parameter to `AuthFunc`

Would you consider adding the request as a parameter to the custom AuthFunc (or--for compatibility reasons--perhaps add a AuthFuncWithRequest or something)? One obvious use case would be to add the authenticated user to the request using for example https://github.com/gorilla/context.

logout

How might I logout a user?

Maintainer contact info

Hey,

My name is Hadas and I'm a Security Analyst at Snyk Security Team.
Wondering if there's anyone maintaining this package currently that we could contact privatley?

Thanks!

Provide an example on how to inject database connection in custom authFunc

Hello,
I'm looking for a way to inject a database session when calling custom authFunc.

Here is the use-case : in main let's open a mongo db connection. How could I inject this connection in my custom authFunc to challenge the password in the database.

I could open a specific connection inside the authFunc for the challenge but this would not be really good pattern.

Can you provide hints ? Or should I fork this repo to change arguments in authFunc call ?

Thanks.

more auth methods

Hi there. Just curious are you still maintaining this? Any thoughts on supporting more auth methods based on the authorization header?

authorization bearer = token auth
authorization basic = user:pass auth
etc...

Basic Auth allows empty user/pass

Does it make sense to call goji.Use(httpauth.SimpleBasicAuth("", "")) (with empty user/pass)?

I think it could cause security issues, ex: I set the user/pass on env vars, and if I forget to set the vars on the production environment my api runs without authentication.

I think it makes sense to validate if a user and pass is provided to this method, what do you guys think?

I could send a PR if this makes sense for you.

Support htpasswd

Support htpasswd and allow multiple accounts.

This project https://github.com/abbot/go-http-auth does support htpasswd, but it does not support wrapping http.Handler.

Set Up Travis CI

@zenazn - for when you have a moment:

• Set up Travis CI
• Add button to README.md