Go Authentication Design Patterns

goodAuthPattern.go

package main

import (
        "log"
        "net/http"
        "os"

        "github.com/gorilla/sessions"
)

var store = sessions.NewCookieStore([]byte(os.Getenv("SESSION-INTEGRITY")))

func authenticated(w http.ResponseWriter, r *http.Request) {
        w.Write([]byte("Why yes, you are logged in!"))
}

func main() {
        authMux := http.NewServeMux()
        authMux.HandleFunc("/authenticated", authenticated)
        apiMux := http.NewServeMux()
        apiMux.HandleFunc("/", func(w http.ResponseWriter, r *http.Request) {
                if session, err := store.Get(r, "SESSIONID"); err == nil {
                        if _, ok := session.Values["loggedin"]; !ok {
                                w.WriteHeader(http.StatusUnauthorized)
                                return
                        }
                        handleFunc, _ := authMux.Handler(r)
                        handleFunc.ServeHTTP(w, r)
                } else {
                        w.WriteHeader(http.StatusInternalServerError)
                }
        })
        log.Fatal(http.ListenAndServe(":8080", apiMux))
}