9.6 http中间件

Posted 2020-10-28 cucy

package main

import (
    "io"
    "log"
    "net/http"
)

type User string

func (u User) toString() string {
    return string(u)
}

type AuthHandler func(u User, w http.ResponseWriter, r *http.Request)

func main() {

    // Secured API
    mux := http.NewServeMux()
    mux.HandleFunc("/api/users", Secure(func(w http.ResponseWriter, r *http.Request) {
        io.WriteString(w, `[{"id":"1","login":"ffghi"},{"id":"2","login":"ffghj"}]`)
    }))
    mux.HandleFunc("/api/profile", WithUser(func(u User, w http.ResponseWriter, r *http.Request) {
        log.Println(u.toString())
        io.WriteString(w, "{\"user\":\""+u.toString()+"\"}")
    }))

    http.ListenAndServe(":8080", mux)

}

func WithUser(h AuthHandler) http.HandlerFunc {
    return func(w http.ResponseWriter, r *http.Request) {
        user := r.Header.Get("X-User")
        if len(user) == 0 {
            w.WriteHeader(http.StatusUnauthorized)
            return
        }
        h(User(user), w, r)
    }

}

func Secure(h http.HandlerFunc) http.HandlerFunc {
    return func(w http.ResponseWriter, r *http.Request) {
        sec := r.Header.Get("X-Auth")
        if sec != "authenticated" {
            w.WriteHeader(http.StatusUnauthorized)
            return
        }
        h(w, r) // use the handler
    }

}

/*
(sx3.5.3) ?  ~ curl -X GET -I http://127.0.0.1:8080/api/users
HTTP/1.1 401 Unauthorized
Date: Mon, 26 Mar 2018 15:42:50 GMT
Content-Length: 0
Content-Type: text/plain; charset=utf-8



curl -X GET -w "\nStatus: %{http_code}\n"  http://127.0.0.1:8080/api/users
Status: 401


curl -X GET -w "\nStatus: %{http_code}\n"  http://127.0.0.1:8080/api/users  -H "X-Auth: authenticated"
[{"id":"1","login":"ffghi"},{"id":"2","login":"ffghj"}]
Status: 200

(sx3.5.3) ?  ~ curl -X GET -w "\nStatus: %{http_code}\n"  http://127.0.0.1:8080/api/profile  -H "X-User: zrd"
{"user":"zrd"}
Status: 200
*/

在前面的例子中中间件的实现利用函数为一等公民的Golang特色。原handlerfunc包装成一个handlerfunc检查x-auth头。安全功能是用来保护handlerfunc，用于servemux的handlefunc方法。

请注意，这只是一个简单的示例，但这种方式可以实现更复杂的解决方案。例如，用户的身份可以从标题标记和随后的提取，处理新类型可以定义为类AuthHandler func（U *用户，W http.responsewriter，R * HTTP请求）。功能的用户创建的servemux的handlerfunc。