使用gocraft Middleware检查HTTP请求的主体

I've been using the gocraft-web package so far to do some development on an HTTP service. It's really great because you can stick middleware in it to check for stuff like the presence of a Cookie in the header.

At the moment I am wanting to implement request signing. Getting the client to sign the request is easy enough, but I am wanting to check it for all endpoints with a common piece of middleware. Basically the middleware needs to find the key to check against, compute the request HMAC, and check it against the supplied HMAC (presumably in the Authorization Header).

Computing the actual HMAC is really easy in go.

The problem is: reading the message in middleware makes it unavailable to the final endpoint.

The best solution I have come up with (example shown below) is to read everything from the Request in the middleware and stuffing it back into a bytes.Buffer for later reading. Is there a better way to do this? The current implementation seems a bit hackish.

Reading everything into memory sucks, but I can probably just put my service behind a proxy and limit the size of requests anyways. The actual content will always be pretty small(under 5 kilobytes). The extra copy introduced by this approach is likely to be quite slow, but computing the HMAC of a message is not exactly cheap to begin with.

The advantage to this is that it is transparent: it will work with any other go http code that just expects to read from Request.Body without any magic.

I suppose I could be a bit slicker and use a io.TeeReader.

This is my solution so far. If you post to localhost:3300 some JSON it prints the sha512 to the terminal in the server process, but also the response is able to contain a listing of the keys & values in it.

package main

import "fmt"
import "github.com/gocraft/web"
import "net/http"
import "bytes"
import "crypto/sha512"
import "io"
import "encoding/hex"
import "encoding/json"

type Context struct{}

type echoer struct {
    *bytes.Buffer
}

func (e echoer) Close() error {
    //Just do nothing to make the interface happy
    return nil
}

func middlewareThatLooksAtBody(rw web.ResponseWriter, req *web.Request, next web.NextMiddlewareFunc) {
    var replacement echoer
    replacement.Buffer = &bytes.Buffer{}

    hash := sha512.New()

    hash.Write([]byte(req.Method))
    reader := req.Body

    var bytes []byte = make([]byte, 64)
    for {
        amount, err := reader.Read(bytes)

        fmt.Printf("Read %d bytes
", amount)

        if err != nil {
            if err == io.EOF {
                break
            }
            panic(err)
        }
        if amount == 0 {
            break
        }

        hash.Write(bytes)
        replacement.Write(bytes)
    }
    //Is this needed?
    reader.Close()

    //replacement.Seek(0, 0)
    req.Body = replacement

    fmt.Printf("%v
", hex.EncodeToString(hash.Sum(nil)))

    next(rw, req)
}

func echoJson(rw web.ResponseWriter, req *web.Request) {
    dec := json.NewDecoder(req.Body)
    var obj map[string]interface{}
    err := dec.Decode(&obj)

    if err != nil {
        rw.WriteHeader(http.StatusBadRequest)
        fmt.Fprintf(rw, "%v
", err)
        return
    }

    for k, v := range obj {
        fmt.Fprintf(rw, "%v = %v
", k, v)
    }
}

func main() {
    router := web.New(Context{})

    router.Middleware(middlewareThatLooksAtBody)
    router.Post("/", echoJson)
    http.ListenAndServe("localhost:3300", router)

}

From your description, it looks like you need to read all the bytes from the request body, regardless of what your handlers will do.

If so, then you have at least a couple of options that would avoid the extra copy:

1) Store the read contents inside your gocraft context.

2) Do all body data processing and validation in the middleware and store the results of the processing in the context.

Granted, this means that your handlers now must know that they should look for the contents in the context instead of the req.Body.

I think it's a decent trade-off though, given your requirements.