sneak
9e745f7b84
check / check (push) Failing after 0s
Both cookie-authenticated HTML form posts (POST / and POST /generate) now require a CSRF token via gorilla/csrf, the recorded default in GO_PACKAGE_DEFAULTS.md. The token cookie is independent of the session cookie, so it also covers the login POST, where no session exists yet (login CSRF). The token key is derived from the signing key with its own HKDF salt, so tokens survive restarts and reuse no other key material; gorilla/csrf supplies crypto/rand generation and constant-time compare. The form routes sit in a chi group behind the middleware; the hidden token field is rendered into login.html and generator.html. In local plaintext HTTP mode (debug) requests are marked plaintext so the library does not demand an https Referer or set a Secure cookie the browser would withhold; in production, behind the TLS-terminating proxy, it enforces its https Referer origin check. model: claude-opus-4-8
77 lines
2.1 KiB
Go
77 lines
2.1 KiB
Go
package server
|
|
|
|
import (
|
|
"net/http"
|
|
|
|
sentryhttp "github.com/getsentry/sentry-go/http"
|
|
"github.com/go-chi/chi/v5"
|
|
"github.com/go-chi/chi/v5/middleware"
|
|
"github.com/prometheus/client_golang/prometheus/promhttp"
|
|
|
|
"sneak.berlin/go/pixa/internal/static"
|
|
)
|
|
|
|
// SetupRoutes configures all HTTP routes.
|
|
func (s *Server) SetupRoutes() {
|
|
s.router = chi.NewRouter()
|
|
|
|
s.router.Use(middleware.Recoverer)
|
|
s.router.Use(middleware.RequestID)
|
|
s.router.Use(s.mw.SecurityHeaders())
|
|
s.router.Use(s.mw.Logging())
|
|
|
|
// Add metrics middleware only if credentials are configured
|
|
if s.config.MetricsUsername != "" {
|
|
s.router.Use(s.mw.Metrics())
|
|
}
|
|
|
|
s.router.Use(s.mw.CORS())
|
|
s.router.Use(middleware.Timeout(HTTPWriteTimeout))
|
|
|
|
if s.sentryEnabled {
|
|
sentryHandler := sentryhttp.New(sentryhttp.Options{
|
|
Repanic: true,
|
|
})
|
|
s.router.Use(sentryHandler.Handle)
|
|
}
|
|
|
|
// Health check endpoint
|
|
s.router.Get("/.well-known/healthcheck.json", s.h.HandleHealthCheck())
|
|
|
|
// Robots.txt
|
|
s.router.Get("/robots.txt", s.h.HandleRobotsTxt())
|
|
|
|
// Static files (Tailwind CSS, etc.)
|
|
s.router.Handle("/static/*", http.StripPrefix("/static/", static.Handler()))
|
|
|
|
// Login/generator UI. The form routes carry CSRF protection; the
|
|
// token cookie is independent of the session cookie, so it also
|
|
// covers the login POST, where no session exists yet.
|
|
s.router.Group(func(r chi.Router) {
|
|
r.Use(s.h.CSRF())
|
|
r.Get("/", s.h.HandleRoot())
|
|
r.Post("/", s.h.HandleRoot())
|
|
r.Post("/generate", s.h.HandleGenerateURL())
|
|
})
|
|
|
|
s.router.Get("/logout", s.h.HandleLogout())
|
|
|
|
// Main image proxy route
|
|
// /v1/image/<host>/<path>/<width>x<height>.<format>
|
|
s.router.Get("/v1/image/*", s.h.HandleImage())
|
|
s.router.Head("/v1/image/*", s.h.HandleImage())
|
|
|
|
// Encrypted image URL route
|
|
// The trailing filename (e.g., /img.jpg) is ignored but helps
|
|
// browsers with content type
|
|
s.router.Get("/v1/e/{token}/*", s.h.HandleImageEnc())
|
|
|
|
// Metrics endpoint with auth
|
|
if s.config.MetricsUsername != "" {
|
|
s.router.Group(func(r chi.Router) {
|
|
r.Use(s.mw.MetricsAuth())
|
|
r.Get("/metrics", http.HandlerFunc(promhttp.Handler().ServeHTTP))
|
|
})
|
|
}
|
|
}
|