Key Auth

El middleware Key Auth proporciona autenticación basada en clave.

• Para una clave válida llama al siguiente handler.
• Para una clave inválida, envía una response 401 Unauthorized.
• Para una clave ausente, envía una response 400 Bad Request.

Todo el middleware principal reside en el paquete middleware:

import "github.com/labstack/echo/v5/middleware"

Uso

e.Use(middleware.KeyAuth(func(c *echo.Context, key string, source middleware.ExtractorSource) (bool, error) {
  return key == "valid-key", nil
}))

Configuración personalizada

e := echo.New()
e.Use(middleware.KeyAuthWithConfig(middleware.KeyAuthConfig{
  KeyLookup: "query:api-key",
  Validator: func(c *echo.Context, key string, source middleware.ExtractorSource) (bool, error) {
    return key == "valid-key", nil
  },
}))

Configuración

KeyAuthConfig · github.com/labstack/echo/v5@5196b9b

Las descripciones de los campos se generan a partir de comentarios del código fuente en inglés.

Campos del código fuente

Campo	Tipo	Descripción	Fuente
Skipper	Skipper	Skipper defines a function to skip middleware.	L21
KeyLookup	string	KeyLookup is a string in the form of "<source>:<name>" or "<source>:<name>,<source>:<name>" that is used to extract key from the request. Optional. Default value "header:Authorization:Bearer ". Possible values: - "header:<name>" or "header:<name>:<cut-prefix>" `<cut-prefix>` is argument value to cut/trim prefix of the extracted value. This is useful if header value has static prefix like `Authorization: <auth-scheme> <authorisation-parameters>` where part that we want to cut is `<auth-scheme> ` note the space at the end. In case of basic authentication `Authorization: Basic <credentials>` prefix we want to remove is `Basic `. - "query:<name>" - "form:<name>" - "cookie:<name>" Multiple sources example: - "header:Authorization,header:X-Api-Key"	L37
AllowedCheckLimit	uint	AllowedCheckLimit set how many KeyLookup values are allowed to be checked. This is useful environments like corporate test environments with application proxies restricting access to environment with their own auth scheme.	L42
Validator	KeyAuthValidator	Validator is a function to validate key. Required.	L46
ErrorHandler	KeyAuthErrorHandler	ErrorHandler defines a function which is executed when all lookups have been done and none of them passed Validator function. ErrorHandler is executed with last missing (ErrExtractionValueMissing) or an invalid key. It may be used to define a custom error. Note: when error handler swallows the error (returns nil) middleware continues handler chain execution towards handler. This is useful in cases when portion of your site/api is publicly accessible and has extra features for authorized users In that case you can use ErrorHandler to set default public auth value to request and continue with handler chain.	L55
ContinueOnIgnoredError	bool	ContinueOnIgnoredError allows the next middleware/handler to be called when ErrorHandler decides to ignore the error (by returning `nil`). This is useful when parts of your site/api allow public access and some authorized routes provide extra functionality. In that case you can use ErrorHandler to set a default public key auth value in the request context and continue. Some logic down the remaining execution chain needs to check that (public) key auth value then.	L62

Funciones del código fuente

Tipo	Fuente
func KeyAuth(fn KeyAuthValidator) echo.MiddlewareFunc	L122
func KeyAuthWithConfig(config KeyAuthConfig) echo.MiddlewareFunc	L133

Validator tiene esta firma:

type KeyAuthValidator func(c *echo.Context, key string, source ExtractorSource) (bool, error)

Configuración por defecto

DefaultKeyAuthConfig = KeyAuthConfig{
  Skipper:   DefaultSkipper,
  KeyLookup: "header:" + echo.HeaderAuthorization + ":Bearer ",
}