Key Auth

Key Auth 中间件提供基于 key 的认证。

• 对于有效 key，它会调用下一个处理函数。
• 对于无效 key，它会发送 401 Unauthorized 响应。
• 对于缺失 key，它会发送 400 Bad Request 响应。

所有核心中间件都位于 middleware 包中：

import "github.com/labstack/echo/v5/middleware"

用法

e.Use(middleware.KeyAuth(func(c *echo.Context, key string, source middleware.ExtractorSource) (bool, error) {
  return key == "valid-key", nil
}))

自定义配置

e := echo.New()
e.Use(middleware.KeyAuthWithConfig(middleware.KeyAuthConfig{
  KeyLookup: "query:api-key",
  Validator: func(c *echo.Context, key string, source middleware.ExtractorSource) (bool, error) {
    return key == "valid-key", nil
  },
}))

配置

KeyAuthConfig · github.com/labstack/echo/v5@5196b9b

字段说明由英文源码注释生成。

包源码中的字段

字段	类型	说明	源码
Skipper	Skipper	Skipper defines a function to skip middleware.	L21
KeyLookup	string	KeyLookup is a string in the form of "<source>:<name>" or "<source>:<name>,<source>:<name>" that is used to extract key from the request. Optional. Default value "header:Authorization:Bearer ". Possible values: - "header:<name>" or "header:<name>:<cut-prefix>" `<cut-prefix>` is argument value to cut/trim prefix of the extracted value. This is useful if header value has static prefix like `Authorization: <auth-scheme> <authorisation-parameters>` where part that we want to cut is `<auth-scheme> ` note the space at the end. In case of basic authentication `Authorization: Basic <credentials>` prefix we want to remove is `Basic `. - "query:<name>" - "form:<name>" - "cookie:<name>" Multiple sources example: - "header:Authorization,header:X-Api-Key"	L37
AllowedCheckLimit	uint	AllowedCheckLimit set how many KeyLookup values are allowed to be checked. This is useful environments like corporate test environments with application proxies restricting access to environment with their own auth scheme.	L42
Validator	KeyAuthValidator	Validator is a function to validate key. Required.	L46
ErrorHandler	KeyAuthErrorHandler	ErrorHandler defines a function which is executed when all lookups have been done and none of them passed Validator function. ErrorHandler is executed with last missing (ErrExtractionValueMissing) or an invalid key. It may be used to define a custom error. Note: when error handler swallows the error (returns nil) middleware continues handler chain execution towards handler. This is useful in cases when portion of your site/api is publicly accessible and has extra features for authorized users In that case you can use ErrorHandler to set default public auth value to request and continue with handler chain.	L55
ContinueOnIgnoredError	bool	ContinueOnIgnoredError allows the next middleware/handler to be called when ErrorHandler decides to ignore the error (by returning `nil`). This is useful when parts of your site/api allow public access and some authorized routes provide extra functionality. In that case you can use ErrorHandler to set a default public key auth value in the request context and continue. Some logic down the remaining execution chain needs to check that (public) key auth value then.	L62

包源码中的函数

类型	源码
func KeyAuth(fn KeyAuthValidator) echo.MiddlewareFunc	L122
func KeyAuthWithConfig(config KeyAuthConfig) echo.MiddlewareFunc	L133

Validator 的签名为：

type KeyAuthValidator func(c *echo.Context, key string, source ExtractorSource) (bool, error)

默认配置

DefaultKeyAuthConfig = KeyAuthConfig{
  Skipper:   DefaultSkipper,
  KeyLookup: "header:" + echo.HeaderAuthorization + ":Bearer ",
}