7690f07a2b
Comprehensive security hardening from audit findings: - Add validation tags to all DTO request structs (max lengths, ranges, enums) - Replace unsafe type assertions with MustGetAuthUser helper across all handlers - Remove query-param token auth from admin middleware (prevents URL token leakage) - Add request validation calls in handlers that were missing c.Validate() - Remove goroutines in handlers (timezone update now synchronous) - Add sanitize middleware and path traversal protection (path_utils) - Stop resetting admin passwords on migration restart - Warn on well-known default SECRET_KEY - Add ~30 new test files covering security regressions, auth safety, repos, and services - Add deploy/ config, audit digests, and AUDIT_FINDINGS documentation Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
51 lines
1.4 KiB
Go
51 lines
1.4 KiB
Go
package middleware
|
|
|
|
import (
|
|
"regexp"
|
|
|
|
"github.com/google/uuid"
|
|
"github.com/labstack/echo/v4"
|
|
)
|
|
|
|
// validRequestID matches alphanumeric characters and hyphens, 1-64 chars.
|
|
var validRequestID = regexp.MustCompile(`^[a-zA-Z0-9\-]{1,64}$`)
|
|
|
|
const (
|
|
// HeaderXRequestID is the header key for request correlation IDs
|
|
HeaderXRequestID = "X-Request-ID"
|
|
// ContextKeyRequestID is the echo context key for the request ID
|
|
ContextKeyRequestID = "request_id"
|
|
)
|
|
|
|
// RequestIDMiddleware generates a UUID per request, sets it as X-Request-ID header,
|
|
// and stores it in the echo context for downstream use.
|
|
func RequestIDMiddleware() echo.MiddlewareFunc {
|
|
return func(next echo.HandlerFunc) echo.HandlerFunc {
|
|
return func(c echo.Context) error {
|
|
// Use existing request ID from header if present and valid, otherwise generate one.
|
|
// Sanitize to alphanumeric + hyphens only (max 64 chars) to prevent
|
|
// log injection via control characters or overly long values.
|
|
reqID := c.Request().Header.Get(HeaderXRequestID)
|
|
if reqID == "" || !validRequestID.MatchString(reqID) {
|
|
reqID = uuid.New().String()
|
|
}
|
|
|
|
// Store in context
|
|
c.Set(ContextKeyRequestID, reqID)
|
|
|
|
// Set response header
|
|
c.Response().Header().Set(HeaderXRequestID, reqID)
|
|
|
|
return next(c)
|
|
}
|
|
}
|
|
}
|
|
|
|
// GetRequestID extracts the request ID from the echo context
|
|
func GetRequestID(c echo.Context) string {
|
|
if id, ok := c.Get(ContextKeyRequestID).(string); ok {
|
|
return id
|
|
}
|
|
return ""
|
|
}
|