Golang : Gorilla web tool kit secure cookie example
Sometimes we need to track user payment status and store the items to be purchased in the browser's cookies cache/jar. It will be wise to encrypt the cookie so that it cannot be manipulated or forged. For example, a malicious buyer will add 3 more items into the cart but only pay for 1 item during check out.
The code below is an example on how to use the Gorilla web tool kit secure cookie package. The cookie is encrypted in the SetCookieHandler()
and the decrypted in the ReadCookieHandler()
.
package main
import (
"fmt"
"github.com/gorilla/mux"
"github.com/gorilla/securecookie"
"net/http"
)
//var hashKey = []byte("very-secret")
//var blockKey = []byte("a-lot-secret")
//var sc = securecookie.New(hashKey, blockKey)
var sc = securecookie.New(securecookie.GenerateRandomKey(64), securecookie.GenerateRandomKey(32))
func SetCookieHandler(w http.ResponseWriter, r *http.Request) {
value := map[string]string{
"name": "username",
}
if encoded, err := sc.Encode("cookie-name", value); err == nil {
cookie := &http.Cookie{
Name: "cookie-name",
Value: encoded,
Path: "/",
}
http.SetCookie(w, cookie)
}
// inspect your cookie cache within your browser...
w.Write([]byte(fmt.Sprintf("Cookie encoded. Inspect your browser's cookies cache")))
}
func ReadCookieHandler(w http.ResponseWriter, r *http.Request) {
w.Write([]byte(fmt.Sprintf("Decoding cookie ")))
// retrieve cookie from request
if cookie, err := r.Cookie("cookie-name"); err == nil {
value := make(map[string]string)
if err = sc.Decode("cookie-name", cookie.Value, &value); err == nil {
w.Write([]byte(fmt.Sprintf("The value of name is %v \n", value["name"])))
}
}
}
func main() {
mx := mux.NewRouter()
mx.HandleFunc("/", SetCookieHandler)
mx.HandleFunc("/get", ReadCookieHandler)
http.ListenAndServe(":8080", mx)
}
Visit the localhost:8080 and you should see this message :
Cookie encoded. Inspect your browser's cookies cache
Under Chrome, the steps are right-click on the page, Inspect Element and click on the Resources tab. You should be able to see a cookie with the name "cookie-name" and some unreadable value.
and visit localhost:8080/get to decrypt the encrypted cookie value.
Hope this helps!
References :
See also : Golang : How to feed or take banana with Gorilla Web Toolkit Session package
By Adam Ng
IF you gain some knowledge or the information here solved your programming problem. Please consider donating to the less fortunate or some charities that you like. Apart from donation, planting trees, volunteering or reducing your carbon footprint will be great too.
Advertisement
Tutorials
+7.3k Golang : Get final or effective URL with Request.URL example
+10.9k Golang : Sort and reverse sort a slice of runes
+11.5k Golang : Send data to /dev/null a.k.a blackhole with ioutil.Discard
+15.8k Golang : Set up source IP address before making HTTP request
+4.8k Linux/Unix/PHP : Restart PHP-FPM
+11k Golang : Get remaining text such as id or filename after last segment in URL path
+9.5k Golang : Resolve domain name to IP4 and IP6 addresses.
+6k Golang : Muxing with Martini example
+20.6k SSL : How to check if current certificate is sha1 or sha2
+34.7k Golang : How to split or chunking a file to smaller pieces?
+5.9k Golang : Skip or discard items of non-interest when iterating example
+32.8k Golang : Create x509 certificate, private and public keys