How to Control Router Access Permissions in Go Web Apps

Alex — Wed, 23 Dec 2020 19:10:56 +0000

In this post I’m going to describe how can we limit user access to the specific url in golang web application. I will use chi router - a lightweight, idiomatic and composable router for building Go HTTP services.

Let’s create our main package.

package main

import (
	"net/http"
	"github.com/go-chi/chi"
)

func main() {
  r := chi.NewRouter()

  r.Get("/", homePageHandler)
  r.Get("/admin", adminPageHandler)
  http.ListenAndServe(":3000", r)
}

func homePageHandler(w http.ResponseWriter, r *http.Request) {
  w.Write([]byte("This is home page")) 
}

func adminPageHandler(w http.ResponseWriter, r *http.Request) {
  w.Write([]byte("This is admin page")) 
}

After this, if we go to the /admin page, we will see “This is admin page”.

Now, let’s make this path accessible only for admin.

We have to replace

r.Get("/admin", adminPageHandler) With r.Mount("/admin", adminRouter())

Mount attaches another http.Handler or chi Router as a subrouter along a routing path.

Then, we have to attach middleware inside adminRouter() function.

func adminRouter() http.Handler {
    r := chi.NewRouter()
    // Middleware with access rules for router.
    r.Use(AdminOnly)
    r.Get("/", adminPageHandler)

    return r
}

In this middleware we have a simple check is user authorized to access this page or not.

func AdminOnly(next http.Handler) http.Handler {
    return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
        // If user is admin, allows access.
        if IsLoggedInAdmin(r) {
            next.ServeHTTP(w, r)
        } else {
            // Otherwise, 403.
            http.Error(w, http.StatusText(403), 403)
            return
        }

        return
    })
}

In sake of demonstration, I’m going just to use a random bool function to decide is used admin or not. You can modify this function according to your user authentication model.

func IsLoggedInAdmin(r *http.Request) bool {
    return rand.Float32() < 0.5
}

And that’s it. Looks really simple, Isn’t it?

Let’s go to to the /admin page again.

As you see, now, sometimes (depends on our random decider), user has no access to this page anymore.

You can find source code here

This builds directly on the pattern from Go middleware example: how to alter a handler result. For the authentication half of the problem, see user authentication in Go Echo with JWT.

Go middleware example. How to alter a handler result

Alex — Sun, 20 Dec 2020 20:12:51 +0000

Let’s imagine a situation when you want to alter the result, returned by some http handler to the client. Fortunately, Golang provides an easy mechanism for that, called a middleware. I’m going to dive directly to the source code, to save your time.

Imagine, we have this simple web server (here I’m using a chi router):


package main

import (
  "bytes"
  "github.com/go-chi/chi"
  "io"
  "log"
  "net/http"
)

func main() {
  r := chi.NewRouter()
  r.Get("/", myFirstHandler)

  http.ListenAndServe(":3000", r)
}

func myFirstHandler(w http.ResponseWriter, r *http.Request) {
  w.Write([]byte("This is a main page"))
}

When we run this application and visit a frontpage htttp://localhost:3000/, we can see this:

Now we got a new requirement to create another handler which should get all response data from myFirstHandler and add some modification on top.

We can do it easily in this way:

// Adds a new router handler with a middleware myMiddleware.  
r.With(myMiddleware).Get("/other", myFirstHandler)

To be able to read a response from other handler, we have to implement our own ResponseWriter:

type MyResponseWriter struct {
   http.ResponseWriter
   buf *bytes.Buffer
}

// Here we are implementing a Write() function from ResponseWriter with our custom instructions. 
func (myrw *MyResponseWriter) Write(p []byte) (int, error) {
   return myrw.buf.Write(p)
}

And finally, let’s write our middleware:


func myMiddleware(next http.Handler) http.Handler {
   return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
      // Create a response writer:
      myResponseWriter := &MyResponseWriter{
         ResponseWriter: w,
         buf:            &bytes.Buffer{},
      }
      // Here we are pssing our custom response writer to the next http handler.
      next.ServeHTTP(myResponseWriter, r)
      
      // Here we are adding our custom stuff to the response, which we received after http handler execution. 
      myResponseWriter.buf.WriteString(" and some additional modifications")
      
      // And, finally, we are copiing everything back to the original response writer.  if _, err := io.Copy(w, myResponseWriter.buf); err != nil {
         log.`Printf("Failed to send out response: %v", err)
      }
   })
}

Now, if we run our server again and go to /other path, we will see this:

This was a silly example, which will never happen in real life, but, I hope you got an overview how you can play with http handlers and middlewares.

The source code you can found in this repository: https://github.com/alexsergivan/blog-examples/tree/master/middleware

Middleware is where a lot of cross-cutting concerns end up living. Three I have written about since: controlling router access permissions, rate limiting your API, and putting a request-scoped logger in the context.

Routing on WebDevStation

How to Control Router Access Permissions in Go Web Apps

Go middleware example. How to alter a handler result