Rate limiting, CORS, and security headers

1// ponytail: one map + mutex per process. Fine for a single instance.
2// Behind more than one, move to Redis or you get N times the limit.
3type limiter struct {
4	mu      sync.Mutex
5	clients map[string]*rate.Limiter
6	rps     rate.Limit
7	burst   int
8}
9
10func (l *limiter) get(key string) *rate.Limiter {
11	l.mu.Lock()
12	defer l.mu.Unlock()
13	lim, ok := l.clients[key]
14	if !ok {
15		lim = rate.NewLimiter(l.rps, l.burst)
16		l.clients[key] = lim
17	}
18	return lim
19}
20
21func RateLimit(rps float64, burst int) Middleware {
22	l := &limiter{clients: map[string]*rate.Limiter{}, rps: rate.Limit(rps), burst: burst}
23
24	return func(next http.Handler) http.Handler {
25		return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
26			ip, _, _ := net.SplitHostPort(r.RemoteAddr)
27			if !l.get(ip).Allow() {
28				w.Header().Set("Retry-After", "60")
29				httpx.Error(w, 429, "too many requests")
30				return
31			}
32			next.ServeHTTP(w, r)
33		})
34	}
35}

1authLimit := middleware.RateLimit(0.2, 5)    // ~12/minute, burst 5
2apiLimit := middleware.RateLimit(20, 40)     // generous for normal use
3
4mux.Handle("POST /auth/login", authLimit(http.HandlerFunc(h.login)))
5mux.Handle("POST /auth/register", authLimit(http.HandlerFunc(h.register)))

1func CORS(allowed []string) Middleware {
2	ok := make(map[string]bool, len(allowed))
3	for _, o := range allowed {
4		ok[o] = true
5	}
6
7	return func(next http.Handler) http.Handler {
8		return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
9			origin := r.Header.Get("Origin")
10			if ok[origin] {
11				w.Header().Set("Access-Control-Allow-Origin", origin)
12				w.Header().Set("Access-Control-Allow-Credentials", "true")
13				w.Header().Set("Access-Control-Allow-Headers", "Authorization, Content-Type")
14				w.Header().Set("Access-Control-Allow-Methods", "GET, POST, PATCH, DELETE")
15				w.Header().Set("Vary", "Origin")      // or a cache serves the wrong header
16			}
17			if r.Method == http.MethodOptions {
18				w.WriteHeader(http.StatusNoContent)   // the preflight
19				return
20			}
21			next.ServeHTTP(w, r)
22		})
23	}
24}

1func SecureHeaders(next http.Handler) http.Handler {
2	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
3		w.Header().Set("X-Content-Type-Options", "nosniff")
4		w.Header().Set("X-Frame-Options", "DENY")
5		w.Header().Set("Referrer-Policy", "no-referrer")
6		w.Header().Set("Strict-Transport-Security", "max-age=63072000; includeSubDomains")
7		next.ServeHTTP(w, r)
8	})
9}

1var client = &http.Client{
2	Timeout: 10 * time.Second,          // http.DefaultClient has NO timeout. Ever.
3	Transport: &http.Transport{
4		MaxIdleConns:        100,
5		MaxIdleConnsPerHost: 100,       // the default is 2 — a hidden bottleneck
6		IdleConnTimeout:     90 * time.Second,
7	},
8}
9
10resp, err := client.Do(req)
11if err != nil {
12	return err
13}
14defer resp.Body.Close()
15defer io.Copy(io.Discard, resp.Body)   // drain it, or the connection is not reused