func (ri *RequestId) Filter(req zerver.Request, resp zerver.Response, chain zerver.FilterChain) {
if req.ReqMethod() == zerver.METHOD_GET {
chain(req, resp)
return
}
reqId := req.GetHeader(ri.HeaderName)
if reqId == "" {
if ri.PassingOnNoId {
chain(req, resp)
} else {
resp.StatusCode(http.StatusBadRequest)
}
} else {
ip := http2.IpOfAddr(req.RemoteAddr())
id := ip + ":" + reqId
if err := ri.Store.Save(id); err == ErrRequestIDExist {
resp.StatusCode(http.StatusForbidden)
} else if err != nil {
ri.log.Warn(log.M{"msg": "save request id failed", "err": err.Error()})
} else {
chain(req, resp)
ri.Store.Remove(id)
}
}
}
func (x *Xsrf) VerifyFor(req zerver.Request) bool {
m := req.ReqMethod()
if !x.FilterGet && (m == zerver.METHOD_GET || m == zerver.METHOD_HEAD || m == zerver.METHOD_OPTIONS) {
return true
}
token := req.GetHeader(_HEADER_XSRFTOKEN)
if token == "" {
token = req.GetHeader(_HEADER_CSRFTOKEN)
if token == "" {
token = req.Vars().QueryVar(_XSRF_PARAM_NAME)
if token == "" {
return false
}
}
}
data := x.verify(unsafe2.Bytes(token))
if data != nil {
x.Pool.Put(data)
t, ip := x.TokenInfo.Unmarshal(data)
return t != -1 &&
t+x.Timeout >= time2.Now().Unix() &&
ip == http2.IpOfAddr(req.RemoteAddr())
}
return false
}
func (c *CORS) filter(req zerver.Request, resp zerver.Response, chain zerver.FilterChain) {
headers := resp.Headers()
origin := "*"
if !c.allowAll {
origin = req.GetHeader(_CORS_ORIGIN)
if !c.allow(origin) {
resp.StatusCode(http.StatusForbidden)
return
}
}
headers.Set(_CORS_ALLOWORIGIN, origin)
headers.Set(_CORS_ALLOWMETHODS, c.methods)
headers.Set(_CORS_ALLOWHEADERS, c.headers)
headers.Set(_CORS_ALLOWCREDENTIALS, c.allowCredentials)
if c.exposeHeaders != "" {
headers.Set(_CORS_EXPOSEHEADERS, c.exposeHeaders)
}
if c.preflightMaxage != "" {
headers.Set(_CORS_MAXAGE, c.preflightMaxage)
}
chain(req, resp)
}
func (c *CORS) Filter(req zerver.Request, resp zerver.Response, chain zerver.FilterChain) {
reqMethod := req.GetHeader(_CORS_REQUESTMETHOD)
reqHeaders := req.GetHeader(_CORS_REQUESTHEADERS)
if req.ReqMethod() == zerver.METHOD_OPTIONS && (reqMethod != "" || reqHeaders != "") {
c.preflight(req, resp, reqMethod, reqHeaders)
} else {
c.filter(req, resp, chain)
}
}
func (l *Log) Filter(req zerver.Request, resp zerver.Response, chain zerver.FilterChain) {
now := time2.Now()
chain(req, resp)
cost := time2.Now().Sub(now)
l.log.Info(log.M{
"method": req.ReqMethod(),
"url": req.URL().String(),
"remote": req.RemoteAddr(),
"userAgent": req.GetHeader(zerver.HEADER_USERAGENT),
"cost": cost.String(),
"statusCode": resp.StatusCode(0),
})
}
func Compress(req zerver.Request, resp zerver.Response, chain zerver.FilterChain) {
encoding := req.GetHeader(zerver.HEADER_ACCEPTENCODING)
respHeaders := resp.Headers()
if strings.Contains(encoding, zerver.ENCODING_GZIP) {
respHeaders.Set(zerver.HEADER_CONTENTENCODING, zerver.ENCODING_GZIP)
resp.Wrap(gzipWrapper)
} else if strings.Contains(encoding, zerver.ENCODING_DEFLATE) {
respHeaders.Set(zerver.HEADER_CONTENTENCODING, zerver.ENCODING_DEFLATE)
resp.Wrap(flateWrapper)
} else {
chain(req, resp)
return
}
chain(req, resp)
respHeaders.Del(zerver.HEADER_CONTENTLENGTH)
}
func (c *CORS) preflight(req zerver.Request, resp zerver.Response, method, headers string) {
origin := "*"
if !c.allowAll {
origin = req.GetHeader(_CORS_ORIGIN)
if !c.allow(origin) {
resp.StatusCode(http.StatusOK)
return
}
}
respHeaders := resp.Headers()
respHeaders.Set(_CORS_ALLOWORIGIN, origin)
upperMethod := strings.ToUpper(method)
for _, m := range c.Methods {
if m == upperMethod {
respHeaders.Add(_CORS_ALLOWMETHODS, method)
break
}
}
for _, h := range strings2.SplitAndTrim(headers, ",") {
for _, ch := range c.Headers {
if strings.ToLower(h) == ch { // c.Headers already ToLowered when Init
respHeaders.Add(_CORS_ALLOWHEADERS, ch)
break
}
}
}
respHeaders.Set(_CORS_ALLOWCREDENTIALS, c.allowCredentials)
if c.exposeHeaders != "" {
respHeaders.Set(_CORS_EXPOSEHEADERS, c.exposeHeaders)
}
if c.preflightMaxage != "" {
respHeaders.Set(_CORS_MAXAGE, c.preflightMaxage)
}
resp.StatusCode(http.StatusOK)
}
