secure.go RawHistoryFolder

1package middleware
2
3import (
4	"log"
5	"os"
6
7	"github.com/bnema/gordon/internal/server"
8	"github.com/gorilla/sessions"
9	_ "github.com/joho/godotenv/autoload"
10	"github.com/labstack/echo-contrib/session"
11	"github.com/labstack/echo/v4"
12	"github.com/labstack/echo/v4/middleware"
13)
14
15func SecureRoutes() echo.MiddlewareFunc {
16	return middleware.SecureWithConfig(middleware.SecureConfig{
17		XSSProtection:         "1; mode=block",
18		ContentTypeNosniff:    "nosniff",
19		XFrameOptions:         "SAMEORIGIN",
20		HSTSMaxAge:            3600,
21		HSTSExcludeSubdomains: false,
22		ContentSecurityPolicy: "default-src 'self'; style-src 'self' 'unsafe-inline'; font-src 'self' data:; img-src 'self' data:; script-src 'self' 'unsafe-inline'",
23	})
24}
25
26// InitSessionMiddleware initializes the session middleware with secure options
27func InitSessionMiddleware(a *server.App) echo.MiddlewareFunc {
28	isHttps := a.Config.Http.Https
29	secret := os.Getenv("SESSION_SECRET")
30	if secret == "" {
31		log.Fatal("Environment variable SESSION_SECRET is not set or cannot be read")
32	}
33	store := sessions.NewCookieStore([]byte(secret))
34	store.Options = &sessions.Options{
35		Path:     "/",
36		HttpOnly: true,
37		Secure:   isHttps,
38		MaxAge:   86400,
39	}
40	return func(next echo.HandlerFunc) echo.HandlerFunc {
41		return func(c echo.Context) error {
42			err := session.Middleware(store)(next)(c)
43			if err != nil {
44				log.Printf("Error in session middleware: %v", err)
45				return err
46			}
47			sess, err := session.Get("session", c)
48			if err != nil {
49				log.Printf("Could not retrieve session: %v", err)
50			} else {
51				log.Printf("Session values: %+v", sess.Values)
52			}
53			return nil
54		}
55	}
56}