Make HTTP middleware easier to use

server/auth/xsrf/xsrf.go

 // Copyright 2015 The LUCI Authors. All rights reserved.
 // Use of this source code is governed under the Apache License, Version 2.0
 // that can be found in the LICENSE file.
 
 // Package xsrf provides Cross Site Request Forgery prevention middleware.
 //
 // Usage:
 //   1. When serving GET request put hidden "xsrf_token" input field with
 //      the token value into the form. Use TokenField(...) to generate it.
 //   2. Wrap POST-handling route with WithTokenCheck(...) middleware.
 package xsrf
 
 import (
         "fmt"
         "html/template"
         "net/http"
         "time"
 
-        "github.com/julienschmidt/httprouter"
         "golang.org/x/net/context"
 
         "github.com/luci/luci-go/common/errors"
         "github.com/luci/luci-go/common/logging"
 
         "github.com/luci/luci-go/server/auth"
-        "github.com/luci/luci-go/server/middleware"
+        "github.com/luci/luci-go/server/router"
         "github.com/luci/luci-go/server/tokens"
 )
 
 // xsrfToken described how to generate tokens.
 var xsrfToken = tokens.TokenKind{
         Algo:       tokens.TokenAlgoHmacSHA256,
         Expiration: 4 * time.Hour,
         SecretKey:  "xsrf_token",
         Version:    1,
 }
@@ skipping 26 matching lines @@
                 panic(err)
         }
         return template.HTML(fmt.Sprintf(`<input type="hidden" name="xsrf_token" value="%s">`, tok))
 }
 
 // WithTokenCheck is middleware that checks validity of XSRF tokens.
 //
 // If searches for the token in "xsrf_token" POST form field (as generated by
 // TokenField). Aborts the request with HTTP 403 if XSRF token is missing or
 // invalid.
-func WithTokenCheck(h middleware.Handler) middleware.Handler {
-        return func(c context.Context, rw http.ResponseWriter, r *http.Request, p httprouter.Params) {
-                tok := r.PostFormValue("xsrf_token")
-                if tok == "" {
-                        replyError(c, rw, http.StatusForbidden, "XSRF token is missing")
-                        return
-                }
-                switch err := Check(c, tok); {
-                case errors.IsTransient(err):
-                        replyError(c, rw, http.StatusInternalServerError, "Transient error when checking XSRF token - %s", err)
-                case err != nil:
-                        replyError(c, rw, http.StatusForbidden, "Bad XSRF token - %s", err)
-                default:
-                        h(c, rw, r, p)
-                }
+func WithTokenCheck(c *router.Context, next router.Handler) {
+        tok := c.Request.PostFormValue("xsrf_token")
+        if tok == "" {
+                replyError(c.Context, c.Writer, http.StatusForbidden, "XSRF token is missing")
+                return
+        }
+        switch err := Check(c.Context, tok); {
+        case errors.IsTransient(err):
+                replyError(c.Context, c.Writer, http.StatusInternalServerError, "Transient error when checking XSRF token - %s", err)
+        case err != nil:
+                replyError(c.Context, c.Writer, http.StatusForbidden, "Bad XSRF token - %s", err)
+        default:
+                next(c)
         }
 }
 
 ///
 
 // state must return exact same value when generating and verifying token for
 // the verification to succeed.
 func state(c context.Context) []byte {
         return []byte(auth.CurrentUser(c).Identity)
 }
 
 // replyError sends error response and logs it.
 func replyError(c context.Context, rw http.ResponseWriter, code int, msg string, args ...interface{}) {
         text := fmt.Sprintf(msg, args...)
         logging.Errorf(c, "xsrf: %s", text)
         http.Error(rw, text, code)
 }