深入理解Go语言中基于Handler的中间件与请求数据传递

package main

import (
    "fmt"
    "net/http"
)

// checkCSRF 是一个基于Handler的中间件，用于执行CSRF检查
func checkCSRF(next http.HandlerFunc) http.HandlerFunc {
    return func(w http.ResponseWriter, r *http.Request) {
        // 模拟CSRF检查逻辑
        if r.Method == http.MethodPost {
            // 假设从请求头或表单中获取CSRF token并验证
            csrfToken := r.Header.Get("X-CSRF-Token")
            if csrfToken == "" || csrfToken != "valid-csrf-token" { // 简化判断
                http.Error(w, "CSRF token invalid or missing", http.StatusForbidden)
                return
            }
            fmt.Println("CSRF check passed for POST request.")
        } else {
            fmt.Println("CSRF check skipped for non-POST request.")
        }
        // 如果检查通过，调用链中的下一个Handler
        next(w, r)
    }
}

// myHandler 是一个示例的业务处理函数
func myHandler(w http.ResponseWriter, r *http.Request) {
    fmt.Fprintf(w, "Hello from myHandler! Request method: %s\n", r.Method)
}

func main() {
    // 将中间件应用到特定的处理函数
    http.HandleFunc("/secure", checkCSRF(myHandler))

    fmt.Println("Server listening on :8080")
    http.ListenAndServe(":8080", nil)
}

// CSRFHandlerFunc 是一种自定义的HandlerFunc类型，用于传递CSRF token
type CSRFHandlerFunc func(w http.ResponseWriter, r *http.Request, t string)

// csrfCheck 中间件尝试使用自定义签名
func csrfCheck(next CSRFHandlerFunc) http.HandlerFunc {
    return func(w http.ResponseWriter, r *http.Request) {
        // ... CSRF 逻辑 ...
        token := "generated-csrf-token" // 假设生成了token
        next(w, r, token) // 传递 token
    }
}

// myCustomHandler 必须匹配 CSRFHandlerFunc 的签名
func myCustomHandler(w http.ResponseWriter, r *http.Request, token string) {
    fmt.Fprintf(w, "Handler received CSRF token: %s\n", token)
}

// 这种方式无法直接与 http.HandleFunc 配合，因为 http.HandleFunc 期望 http.HandlerFunc
// http.HandleFunc("/path", csrfCheck(myCustomHandler)) // 编译错误

package main

import (
    "context"
    "fmt"
    "net/http"
)

// 定义一个非导出类型作为上下文键，避免冲突
type contextKey string

const csrfTokenKey contextKey = "csrfToken"

// generateCSRFTokenAndStore 是一个中间件，用于生成CSRF token并存入context
func generateCSRFTokenAndStore(next http.HandlerFunc) http.HandlerFunc {
    return func(w http.ResponseWriter, r *http.Request) {
        // 模拟生成CSRF token
        token := "unique-generated-csrf-token-12345"
        fmt.Printf("Middleware generated CSRF token: %s\n", token)

        // 将token存入请求的context中
        ctx := context.WithValue(r.Context(), csrfTokenKey, token)
        // 使用新的context更新请求
        r = r.WithContext(ctx)

        // 调用链中的下一个Handler
        next(w, r)
    }
}

// checkCSRFMiddleware 是一个中间件，用于从context中获取并验证CSRF token
func checkCSRFMiddleware(next http.HandlerFunc) http.HandlerFunc {
    return func(w http.ResponseWriter, r *http.Request) {
        if r.Method == http.MethodPost {
            // 从context中获取生成的token
            val := r.Context().Value(csrfTokenKey)
            token, ok := val.(string)
            if !ok {
                http.Error(w, "CSRF token not found in context", http.StatusInternalServerError)
                return
            }

            // 模拟验证请求中的token与context中的token
            requestToken := r.Header.Get("X-CSRF-Token")
            if requestToken == "" || requestToken != token {
                http.Error(w, "CSRF token invalid or missing", http.StatusForbidden)
                return
            }
            fmt.Println("CSRF check passed using token from context.")
        }
        next(w, r)
    }
}

// finalHandler 是最终的业务处理函数，从context中获取CSRF token
func finalHandler(w http.ResponseWriter, r *http.Request) {
    // 从context中获取CSRF token
    val := r.Context().Value(csrfTokenKey)
    token, ok := val.(string)
    if !ok {
        http.Error(w, "CSRF token not found for final handler", http.StatusInternalServerError)
        return
    }
    fmt.Fprintf(w, "Hello from finalHandler! CSRF Token from context: %s\n", token)
}

func main() {
    // 堆叠多个中间件
    // 请求将依次经过 generateCSRFTokenAndStore -> checkCSRFMiddleware -> finalHandler
    chain := generateCSRFTokenAndStore(checkCSRFMiddleware(finalHandler))
    http.HandleFunc("/secure", chain)

    fmt.Println("Server listening on :8080")
    http.ListenAndServe(":8080", nil)
}

// 另一个示例中间件：记录请求
func loggingMiddleware(next http.HandlerFunc) http.HandlerFunc {
    return func(w http.ResponseWriter, r *http.Request) {
        fmt.Printf("Request received: %s %s\n", r.Method, r.URL.Path)
        next(w, r)
        fmt.Printf("Request processed: %s %s\n", r.Method, r.URL.Path)
    }
}

func main() {
    // 堆叠多个中间件
    // 请求将依次经过 loggingMiddleware -> generateCSRFTokenAndStore -> checkCSRFMiddleware -> finalHandler
    chainedHandlers := loggingMiddleware(
        generateCSRFTokenAndStore(
            checkCSRFMiddleware(
                finalHandler,
            ),
        ),
    )
    http.HandleFunc("/secure", chainedHandlers)

    fmt.Println("Server listening on :8080")
    http.ListenAndServe(":8080", nil)
}

// import "github.com/gorilla/context"

// func myGorillaMiddleware(next http.HandlerFunc) http.HandlerFunc {
//     return func(w http.ResponseWriter, r *http.Request) {
//         // 存储数据
//         context.Set(r, "myKey", "myValue")
//         defer context.Clear(r) // 清理上下文，避免内存泄漏

//         next(w, r)
//     }
// }

// func myGorillaHandler(w http.ResponseWriter, r *http.Request) {
//     // 获取数据
//     val := context.Get(r, "myKey")
//     if strVal, ok := val.(string); ok {
//         fmt.Fprintf(w, "Value from Gorilla context: %s\n", strVal)
//     }
// }