Go Authentication Design Pattern

goodAuthPatternAndUnauth.go

package main

import (
        "log"
        "net/http"
        "os"

        "github.com/gorilla/sessions"
)

var store = sessions.NewCookieStore([]byte(os.Getenv("SESSION-INTEGRITY")))

func authenticated(w http.ResponseWriter, r *http.Request) {
        w.Write([]byte("Why yes, you are logged in!"))
}
func unauthenticated(w http.ResponseWriter, r *http.Request) {
        w.Write([]byte("You are not authenticated"))
}

func main() {
        unauthMux := http.NewServeMux()
        unauthMux.HandleFunc("/authenticated", unauthenticated)
        authMux := http.NewServeMux()
        authMux.HandleFunc("/authenticated", authenticated)
        apiMux := http.NewServeMux()
        apiMux.HandleFunc("/", func(w http.ResponseWriter, r *http.Request) {
                if session, err := store.Get(r, "SESSIONID"); err == nil {
                        activeMux := unauthMux
                        if _, ok := session.Values["loggedin"]; ok {
                                activeMux = authMux
                        }
                        handleFunc, _ := activeMux.Handler(r)
                        handleFunc.ServeHTTP(w, r)
                } else {
                        w.WriteHeader(http.StatusInternalServerError)
                }
        })
        log.Fatal(http.ListenAndServe(":8080", apiMux))
}