Full Web Application - go-security

Wires the web layer end to end: server-side sessions, CSRF protection, a JSON login/logout pair, remember-me, CORS, and the security-headers/anonymous middlewares — all behind one middleware.Chain. Everything is in-memory; there is no database or external dependency to stand up.

Running it

export REMEMBER_ME_KEY=$(openssl rand -base64 32)
go run ./examples/webapp

The remember-me HMAC key must come from the environment — the example fails fast (log.Fatal) if REMEMBER_ME_KEY is unset or shorter than 32 bytes, since a committed key would let anyone with repo access forge remember-me tokens.

The chain, top to bottom

Browser
  │
  ▼
middleware.Chain
  ├─ SecurityHeaders  — defensive response headers (nosniff, X-Frame-Options)
  ├─ CORS             — answers preflights, gates cross-origin requests
  ├─ sessionResolver   — turns the SESSION cookie into a core.Authentication
  ├─ RememberMe        — if no session auth, tries the remember-me cookie
  ├─ Anonymous         — if still unauthenticated, injects an anonymous token
  ├─ CSRF              — issues a token on safe methods, validates unsafe ones
  └─ Your mux
       ├─ POST /login
       ├─ POST /logout
       └─ GET  /me

The /login and /logout endpoints are mounted on a mux that the chain wraps.

Key configuration

Users, encoder, manager

encoder := password.NewBcryptEncoder(password.DefaultBcryptCost)
hash, _ := encoder.Encode("s3cret")

users := authn.NewInMemoryUserService()
users.Add(authn.User{
    Username:     "alice",
    PasswordHash: hash,
    Authorities:  core.Roles("USER"),
})
manager := authn.NewManager([]authn.Provider{
    authn.NewPasswordProvider(users, encoder),
})

Session store

store := session.NewMemoryStore(session.Options{})
cookie := session.DefaultCookieConfig() // Secure + HttpOnly + SameSite=Lax

Remember-me

The fetcher returns a fragment of the user’s stored password hash, so a password change invalidates outstanding remember-me tokens automatically — no separate revocation list to maintain:

rememberKey := []byte(os.Getenv("REMEMBER_ME_KEY"))
if len(rememberKey) < 32 {
    log.Fatal("REMEMBER_ME_KEY must be set to at least 32 bytes")
}
rememberSvc, err := rememberme.NewTokenBased(rememberme.TokenBasedConfig{
    Key:    rememberKey,
    Cookie: session.CookieConfig{Secure: true},
    Fetcher: func(ctx context.Context, username string) (string, bool) {
        u, lerr := users.LoadUser(ctx, username)
        if lerr != nil {
            return "", false
        }
        frag := u.PasswordHash
        if len(frag) > 8 {
            frag = frag[len(frag)-8:]
        }
        return frag, true
    },
})

CSRF (session-backed synchronizer token)

csrfRepo := csrf.NewSynchronizerRepository(store, cookie)
csrfMiddleware := csrf.Middleware(csrf.Config{
    Repo: csrfRepo,
    // No session exists yet at /login, so there is no synchronizer token to
    // validate there. Subsequent state-changing requests are protected once
    // a session (and token) exist.
    Skip: func(r *http.Request) bool {
        return r.URL.Path == "/login"
    },
})

CORS

corsMiddleware, err := cors.New(cors.Config{
    AllowedOrigins:   []string{"https://app.example.com"},
    AllowCredentials: true, // safe: no "*" origin alongside credentials
    AllowedHeaders:   []string{"Content-Type", "X-CSRF-Token"},
})

The one chain that wraps everything

chain := mw.New(
    mw.SecurityHeaders(),
    corsMiddleware,
    sessionResolver(store, cookie, users),
    rememberme.Middleware(rememberSvc),
    mw.Anonymous(),
    csrfMiddleware,
)
handler := chain.Then(mux)

sessionResolver is a small example middleware, not a library type: it reads the SESSION cookie, loads the session, and reloads the user’s authorities from the UserService on every request — so a revoked role or a disabled/ locked account takes effect immediately rather than being frozen at login time.

Trying it out

The running process listens on plain http://localhost:8080 (see http.ListenAndServe(":8080", handler) in main); the package doc comment’s https://localhost:8443 curl example describes a real TLS-terminated deployment, not this exact process. /me has no authz route rule guarding it, so it is reachable unauthenticated — core.MustAuthentication never panics because Anonymous() always puts some authentication (anonymous or real) on the context:

curl http://localhost:8080/me
# → hello anonymousUser

curl -c jar.txt -X POST http://localhost:8080/login \
     -H 'Content-Type: application/json' \
     -d '{"username":"alice","password":"s3cret","remember-me":true}'
# → 200 {"authenticated":true}

curl -b jar.txt http://localhost:8080/me
# → hello alice

curl http://localhost:8080/me
# → 401 Unauthorized (no session yet)

curl -c jar.txt -X POST http://localhost:8080/login \
     -H 'Content-Type: application/json' \
     -d '{"username":"alice","password":"s3cret"}'

curl -b jar.txt http://localhost:8080/me
# → hello alice

​Running it

​The chain, top to bottom

​Key configuration

​Users, encoder, manager

​Session store

​Remember-me

​CSRF (session-backed synchronizer token)

​CORS

​The one chain that wraps everything

​Trying it out