:golf: The Golf web framework

randomBytes in xsrf.go uses math.rand to generate CSRF tokens. This is unsafe/insecure, and because it is seeded with time.UnixNano, generates predictable results that would allow an attacker to bypass CSRF protection.

sessionID in session.go correctly uses crypto/rand to generate a session ID. You should split this code out and re-use it for both session ID generation and CSRF token generation.

(You're also welcome to import or repurpose https://github.com/gorilla/csrf for this as well, which has some additional mitigations against CSRF bypass)

Issue: #20

Uses crypto/rand instead of math/rand for XSRF token generation, as @elithrar suggested. In that issue it was also suggested that we either use gorilla/csrf or repurpose it for Golf, so this PR may not close the issue.

Hello, I have question about Redirect function. Why Golf use 301 not 302 by default. Because I think redirect with 302 use more than 301. So Is default value should be 302?.

And another problem with 301 is browser will cache the redirection even if you disabled the redirection from the server level. ref: http://stackoverflow.com/questions/1393280/http-redirect-301-permanent-vs-302-temporary

Thanks for created Golf, I just question and suggestion. Sorry for my bad english.

Hello I'm use gopkg to download the dependency by using go get gopkg.in/dinever/golf.v0.

It download the v0.2 not a master branch. and it not provide some function in docs. Like Context.SetHeder(), Contextext.sendStatus(), app.Use(), that master branch have.

Thank you.

I've been (slowly) working on https://github.com/dinever/dingo/issues/6, and noticed that the output of ctx.JSON wasn't very human-readable, since it just uses json.MarshalIndent. I really like the way GitHub has a sort of self-documenting API, and has easy-to-read JSON output, since it is formatted nicely. This PR adds support for the json.MarshalIndent method inside ctx, so that users can choose how to format their JSON output.

Hola! @guoziyan has created a ZenHub account for the dinever organization. ZenHub is the leading team collaboration and project management solution built for GitHub.

How do I use ZenHub?

To get set up with ZenHub, all you have to do is download the browser extension and log in with your GitHub account. Once you do, you’ll get access to ZenHub’s complete feature-set immediately.

What can ZenHub do?

ZenHub adds a series of enhancements directly inside the GitHub UI:

• Real-time, customizable task boards for GitHub issues;
• Burndown charts, estimates, and velocity tracking based on GitHub Milestones;
• Personal to-do lists and task prioritization;
• “+1” button for GitHub issues and comments;
• Drag-and-drop file sharing;
• Time-saving shortcuts like a quick repo switcher.

Add ZenHub to GitHub

Still curious? See more ZenHub features or read user reviews. This issue was written by your friendly ZenHub bot, posted by request from @guoziyan.

It would be great if someone could add some code here to enable stack trace logging for debugging.

And it would be great if stack trace can be printed on the error page, like this:

add TLS support // Run the Golf Application.

func (app *Application) RunTLS(addr, certFile, keyFile) {
    err := http.ListenAndServeTLS(addr, certFile, keyFile, app)
    if err != nil {
        panic(err)
    }
}

Changes:

• Changed default HTTP redirection status to 302, fixes #26
• Added Context.Redirect301 for 301 redirection
• Fixed several golint warnings
• Added Go 1.7 and 1.8 to .travis.yml

1. Moved Session into a middleware.
2. Add mutex in MemorySessionManager to avoid the race condition. Fixes #14
3. Disable session by default
4. Add method Count to SessionManager interface
5. Improved test cases for sessions and XSRF protection

When performing stress testing, I found that concurrent session writes raised an error:

fatal error: concurrent map writes

goroutine 103 [running]:
runtime.throw(0x8bfbf0, 0x15)
    /usr/lib/go/src/runtime/panic.go:530 +0x90 fp=0xc8201735a8 sp=0xc820173590
runtime.mapassign1(0x742fc0, 0xc820011590, 0xc8201736b0, 0xc820173680)
    /usr/lib/go/src/runtime/hashmap.go:445 +0xb1 fp=0xc820173650 sp=0xc8201735a8
github.com/dinever/golf.(*MemorySessionManager).NewSession(0xc820026058, 0x0, 0x0, 0x0, 0x0)
    /home/ubuntu/go/src/github.com/dinever/golf/session.go:54 +0x19c fp=0xc8201736e0 sp=0xc820173650
github.com/dinever/golf.(*Context).generateSession(0xc8206d2200, 0x0, 0x0)
    /home/ubuntu/go/src/github.com/dinever/golf/context.go:63 +0x58 fp=0xc820173758 sp=0xc8201736e0
github.com/dinever/golf.(*Context).retrieveSession(0xc8206d2200)
    /home/ubuntu/go/src/github.com/dinever/golf/context.go:76 +0x88 fp=0xc8201737d8 sp=0xc820173758
github.com/dinever/golf.(*Application).handler(0xc820070550, 0xc8206d2200)
    /home/ubuntu/go/src/github.com/dinever/golf/app.go:75 +0x489 fp=0xc820173990 sp=0xc8201737d8
github.com/dinever/golf.(*Application).(github.com/dinever/golf.handler)-fm(0xc8206d2200)
    /home/ubuntu/go/src/github.com/dinever/golf/app.go:91 +0x2a fp=0xc8201739a8 sp=0xc820173990
github.com/dinever/golf.XSRFProtectionMiddleware.func1(0xc8206d2200)
    /home/ubuntu/go/src/github.com/dinever/golf/middleware.go:61 +0x150 fp=0xc820173a10 sp=0xc8201739a8
github.com/dinever/golf.RecoverMiddleware.func1(0xc8206d2200)
    /home/ubuntu/go/src/github.com/dinever/golf/middleware.go:84 +0x56 fp=0xc820173a38 sp=0xc820173a10
github.com/dinever/golf.LoggingMiddleware.func1(0xc8206d2200)
    /home/ubuntu/go/src/github.com/dinever/golf/middleware.go:44 +0x67 fp=0xc820173b30 sp=0xc820173a38
github.com/dinever/golf.(*Application).ServeHTTP(0xc820070550, 0x7f5cff26c890, 0xc820057110, 0xc82070e7e0)
    /home/ubuntu/go/src/github.com/dinever/golf/app.go:91 +0xc2 fp=0xc820173b70 sp=0xc820173b30
net/http.serverHandler.ServeHTTP(0xc820054500, 0x7f5cff26c890, 0xc820057110, 0xc82070e7e0)
    /usr/lib/go/src/net/http/server.go:2081 +0x19e fp=0xc820173bd0 sp=0xc820173b70
net/http.(*conn).serve(0xc8204cce00)
    /usr/lib/go/src/net/http/server.go:1472 +0xf2e fp=0xc820173f98 sp=0xc820173bd0
runtime.goexit()
    /usr/lib/go/src/runtime/asm_amd64.s:1998 +0x1 fp=0xc820173fa0 sp=0xc820173f98
created by net/http.(*Server).Serve
    /usr/lib/go/src/net/http/server.go:2137 +0x44e

I think we need to add something like a mutex on the in MemorySessionManager.NewSession to fix this.

package main

import (
"github.com/dinever/golf"
 
)

 

func pageHandler(ctx *golf.Context) {
	ctx.Send("Page: " + ctx.Param("page"))
}
func main() {
	app := golf.New()

	 
	app.Get("/p/:page/", pageHandler)
	app.Run(":9000")
}

visit http://localhost:9000/p/

package main

import "github.com/dinever/golf"

func pageHandler(ctx *golf.Context) {
  ctx.Write("Page: " + ctx.Param("page"))
}

func main() {
  app := golf.New()
  app.Get("/p/:page/", pageHandler)
  app.Run(":9000")
}

Both appears to not be possible - FormValue does not contain any data, if it is a file. For WebSockets, it would require to expose net/http handlers, which doesn't appear to be possible.

Is there any way to make either of those work inside Golf?

Would like to see a MemorySession pool in the MemorySessionManager.

We can use the pool for new MemorySession creation to avoid frequent memory allocation.

Currently Golf stores cookies explicitly. Let's create a secure cookie method Context.SecureCookie & Context.SetSecureCookie to allow encrypting the cookies using a symmetric key.

Before using the secure cookie, the user should set a secret_token, which will be used as the symmetric encryption key in the app configuration.

Router should have the ability to route a path to another app, so that there can be several apps in a single project.

Like this:

app = NewApp()
anotherApp = NewApp()
app.Route("/admin", anotherApp)