In this video, we are going to look at how we can start to tighten up the security of some of our endpoints and ensure that only those with the correct username and password can effectively access some of the endpoints within our app.
Let’s get started by creating this new function:
// BasicAuth - a handy middleware function that logs out incoming requests
func BasicAuth(original func(w http.ResponseWriter, r *http.Request)) func(w http.ResponseWriter, r *http.Request) {
return func(w http.ResponseWriter, r *http.Request) {
user, pass, ok := r.BasicAuth()
if user == "admin" && pass == "password" && ok {
original(w, r)
} else {
w.Header().Set("Content-Type", "application/json; charset=UTF-8")
sendErrorResponse(w, "not authorized", errors.New("not authorized"))
}
}
}
Next, let’s wrap the endpoints we want to protect with this new function:
// SetupRoutes - sets up all the routes for our application
func (h *Handler) SetupRoutes() {
log.Info("Setting Up Routes")
h.Router = mux.NewRouter()
h.Router.Use(LoggingMiddleware)
h.Router.HandleFunc("/api/comment", h.GetAllComments).Methods("GET")
h.Router.HandleFunc("/api/comment", BasicAuth(h.PostComment)).Methods("POST")
h.Router.HandleFunc("/api/comment/{id}", h.GetComment).Methods("GET")
h.Router.HandleFunc("/api/comment/{id}", BasicAuth(h.UpdateComment)).Methods("PUT")
h.Router.HandleFunc("/api/comment/{id}", BasicAuth(h.DeleteComment)).Methods("DELETE")
h.Router.HandleFunc("/api/health", func(w http.ResponseWriter, r *http.Request) {
w.Header().Set("Content-Type", "application/json; charset=UTF-8")
w.WriteHeader(http.StatusOK)
if err := json.NewEncoder(w).Encode(Response{Message: "I am Alive!"}); err != nil {
panic(err)
}
})
}
Awesome, let’s try and run this with docker-compose up --build. When we now try and hit that endpoint within Postman with no basic auth headers set then we should receive a not authorized response. If we set these headers on our requests then we should be able to successfully insert a new comment into the database!
In the next video, we’ll look at taking this a step further and implementing a JWT validation decorator function that we can use to improve the security even further and move away from basic auth.