Documentation
¶
Index ¶
- Constants
- func CORS(next http.Handler) http.Handler
- func CacheShort(next http.Handler) http.Handler
- func GetRequestID(ctx context.Context) string
- func IsAllowedOrigin(origin string) bool
- func Logging(log zerolog.Logger) func(http.Handler) http.Handler
- func RealIP(next http.Handler) http.Handler
- func RecordRequestStatus(status int)
- func Recover(log zerolog.Logger) func(http.Handler) http.Handler
- func RequestID(next http.Handler) http.Handler
- func SecurityHeaders(next http.Handler) http.Handler
- func SnapshotRequests() (ok2xx, other1xx3xx, clientErr4xx, serverErr5xx uint64)
- type RateLimiter
Constants ¶
const RequestIDKey requestIDKey = "request_id"
Variables ¶
This section is empty.
Functions ¶
func CacheShort ¶
CacheShort marks a response as publicly cacheable for five minutes: the catalog data underneath is itself cached server-side for the same TTL, so a shared/browser cache can absorb repeat reads without re-fetching. Applied per-route to catalog endpoints only, account, sync, streaming, and proxy responses must never be cached by intermediaries.
func GetRequestID ¶
func IsAllowedOrigin ¶
IsAllowedOrigin reports whether an Origin header value is on the CORS allowlist (including ANIRAKU_CORS_ORIGINS extensions). Handlers that must answer CORS outside the middleware chain use this so they cannot drift from the site-wide policy.
func RealIP ¶
RealIP replaces chi's RealIP middleware: chi trusts the leftmost X-Forwarded-For entry, which any client can spoof to dodge per-IP rate limits. Behind a trusted proxy, the true socket peer is appended to X-Forwarded-For, so the client-unforgeable address is the rightmost entry that is not a trusted proxy CIDR. With no trusted CIDRs configured, X-Forwarded-For is ignored entirely and the socket peer is used.
Security: X-Forwarded-For is only honored when the direct TCP peer itself is one of the configured trusted proxies. Otherwise an attacker who can reach the origin directly can append a trusted-looking proxy address and choose the derived client IP (chi CVE-2026-114437 / GHSA-j6qf-3m9c-vwj3).
func RecordRequestStatus ¶
func RecordRequestStatus(status int)
RecordRequestStatus is called by the Logging middleware for every finished request.
func SnapshotRequests ¶
func SnapshotRequests() (ok2xx, other1xx3xx, clientErr4xx, serverErr5xx uint64)
SnapshotRequests returns the current counter values for the metrics endpoint.
Types ¶
type RateLimiter ¶
type RateLimiter struct {
// contains filtered or unexported fields
}
func NewRateLimiter ¶
func NewRateLimiter(rate, burst int, interval time.Duration) *RateLimiter
func (*RateLimiter) Middleware ¶
func (rl *RateLimiter) Middleware(next http.Handler) http.Handler
func (*RateLimiter) Stop ¶
func (rl *RateLimiter) Stop()
Stop halts the background cleanup goroutine. Call on server shutdown to avoid leaking a goroutine on every restart.
Source Files