Golang : Gorilla web tool kit secure cookie example
Sometimes we need to track user payment status and store the items to be purchased in the browser's cookies cache/jar. It will be wise to encrypt the cookie so that it cannot be manipulated or forged. For example, a malicious buyer will add 3 more items into the cart but only pay for 1 item during check out.
The code below is an example on how to use the Gorilla web tool kit secure cookie package. The cookie is encrypted in the SetCookieHandler()
and the decrypted in the ReadCookieHandler()
.
package main
import (
"fmt"
"github.com/gorilla/mux"
"github.com/gorilla/securecookie"
"net/http"
)
//var hashKey = []byte("very-secret")
//var blockKey = []byte("a-lot-secret")
//var sc = securecookie.New(hashKey, blockKey)
var sc = securecookie.New(securecookie.GenerateRandomKey(64), securecookie.GenerateRandomKey(32))
func SetCookieHandler(w http.ResponseWriter, r *http.Request) {
value := map[string]string{
"name": "username",
}
if encoded, err := sc.Encode("cookie-name", value); err == nil {
cookie := &http.Cookie{
Name: "cookie-name",
Value: encoded,
Path: "/",
}
http.SetCookie(w, cookie)
}
// inspect your cookie cache within your browser...
w.Write([]byte(fmt.Sprintf("Cookie encoded. Inspect your browser's cookies cache")))
}
func ReadCookieHandler(w http.ResponseWriter, r *http.Request) {
w.Write([]byte(fmt.Sprintf("Decoding cookie ")))
// retrieve cookie from request
if cookie, err := r.Cookie("cookie-name"); err == nil {
value := make(map[string]string)
if err = sc.Decode("cookie-name", cookie.Value, &value); err == nil {
w.Write([]byte(fmt.Sprintf("The value of name is %v \n", value["name"])))
}
}
}
func main() {
mx := mux.NewRouter()
mx.HandleFunc("/", SetCookieHandler)
mx.HandleFunc("/get", ReadCookieHandler)
http.ListenAndServe(":8080", mx)
}
Visit the localhost:8080 and you should see this message :
Cookie encoded. Inspect your browser's cookies cache
Under Chrome, the steps are right-click on the page, Inspect Element and click on the Resources tab. You should be able to see a cookie with the name "cookie-name" and some unreadable value.
and visit localhost:8080/get to decrypt the encrypted cookie value.
Hope this helps!
References :
See also : Golang : How to feed or take banana with Gorilla Web Toolkit Session package
By Adam Ng
IF you gain some knowledge or the information here solved your programming problem. Please consider donating to the less fortunate or some charities that you like. Apart from donation, planting trees, volunteering or reducing your carbon footprint will be great too.
Advertisement
Tutorials
+9.6k Golang : Validate IPv6 example
+26.8k Golang : How to check if a connection to database is still alive ?
+14.6k Android Studio : Use image as AlertDialog title with custom layout example
+9.1k Golang : Go as a script or running go with shebang/hashbang style
+17.2k Golang : Fix cannot convert buffer (type *bytes.Buffer) to type string error
+11.8k Golang : How to detect a server/machine network interface capabilities?
+34.2k Golang : Create x509 certificate, private and public keys
+8k Golang Hello World Example
+17.3k Golang : When to use init() function?
+11.6k Golang : Change date format to yyyy-mm-dd