A fantastic modular Go web framework boiled with black magic.

Component

Core framework

Middleware

n/a

Version

v1.1.0

Describe the bug

I'm not sure if this is supported but when I'm using a handler that returns ([]byte, error), the response is empty. It works when I only return []byte though.

To reproduce

package main

import (
	"github.com/flamego/flamego"
)

func main() {
	f := flamego.Classic()

	f.Get("/", func() ([]byte, error) {
		return []byte(`{"hello": "world"}`), nil
	})

	f.Run()
}

Expected behavior

See the output in the browser

Additional context

Here are the relevant logs, we can see that the handler actually returns 0 bytes.

[Flamego] 2022-04-08 15:23:03: Started GET / for 100.100.100.100
[Flamego] 2022-04-08 15:23:03: Completed GET / 0  in 100.3µs

Code of Conduct

• [X] I agree to follow this project's Code of Conduct

Component

Middleware

Middleware

https://github.com/flamego/session

Version

1.2.1

Describe the bug

在使用redis存储session时遇到问题 gob: type not registered for interface: time.Time

To reproduce

配置 session 使用 Redis 作为存储。 然后后部加上csrf。 可在flamego/session/redis/redis.go:68 下断点复现。

Expected behavior

正常应该无报错

Additional context

No response

Code of Conduct

• [X] I agree to follow this project's Code of Conduct

Describe the pull request

This PR adds a Cache-Control option for static files that works in the same fashion as the existing Expires option.

Link to the issue: n/a

Checklist

• [x] I agree to follow the Code of Conduct by submitting this pull request.
• [x] I have read and acknowledge the Contributing guide.
• [x] I have added test cases to cover the new code.

Component

Core framework

Middleware

n/a

Is your feature request related to a problem? Please describe

To register a route for multiple HTTP methods, one would use follows:

f.Routes("/", "GET,POST", ...)

However, the use of "GET,POST" looks very non-elegant, and one always needs to type in full characters without editor's auto-completion (because this is literal string).

Describe the solution you'd like

The net/http package provides constants for each HTTP method, e.g. http.MethodGet, we should be able to do things more elegant like:

f.Routes("/", http.MethodGet, http.MethodPost, <my handlers>)

Because these constants are strings after all, the router should be able to distinguished them from handlers, and magically do the trick for users.

Describe alternatives you've considered

n/a

Additional context

No response

Code of Conduct

• [X] I agree to follow this project's Code of Conduct

Component

Middleware

Middleware

https://github.com/flamego/session

Is your feature request related to a problem? Please describe

The session middleware require manual creation of the table for PostgreSQL and MySQL backend.

Describe the solution you'd like

Add an option to the postgres.Config and mysql.Config like the following (field name need to be discussed):

type Config struct{
	// ...
	InitTable bool
}

Which automatically creates the table when not exists.

The SQL to create the table can be derived from the tests.

Describe alternatives you've considered

Live with it.

Additional context

Feel free to ask more details or clarifying questions!

If you would like to contribute on the implementation, please:

1. Comment on the issue for taking the responsibility so everyone knows.
2. Acknowledge that the expected timeline is one week.

Code of Conduct

• [X] I agree to follow this project's Code of Conduct

Describe the pull request

unified middleware format

Checklist

• [x] I agree to follow the Code of Conduct by submitting this pull request.
• [x] I have read and acknowledge the Contributing guide.
• [ ] I have added test cases to cover the new code.

Bumps github.com/alecthomas/participle/v2 from 2.0.0-alpha10 to 2.0.0-beta.1.

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Describe the pull request

Use regex to match headers!

Link to the issue: fixes https://github.com/flamego/flamego/issues/132

Checklist

• [x] I agree to follow the Code of Conduct by submitting this pull request.
• [x] I have read and acknowledge the Contributing guide.
• [x] I have added test cases to cover the new code.

Followup

• [x] Update docs on flamego.dev
• [x] Update docs on flamego.cn

Component

Core framework

Middleware

n/a

Is your feature request related to a problem? Please describe

hi, it that any plan to support router with HeadersRegexp? i want to write S3 web service (looks like minio) with flamego ,but it miss HeadersRegexp func to filter request with header.

https://github.com/minio/minio/blob/master/cmd/api-router.go#L242

// HeadersRegexp accepts a sequence of key/value pairs, where the value has regex
// support. For example:
//
//     r := mux.NewRouter()
//     r.HeadersRegexp("Content-Type", "application/(text|json)",
//               "X-Requested-With", "XMLHttpRequest")
//
// The above route will only match if both the request header matches both regular expressions.
// If the value is an empty string, it will match any value if the key is set.
// Use the start and end of string anchors (^ and $) to match an exact value.

Describe the solution you'd like

https://github.com/gorilla/mux/blob/d07530f46e1eec4e40346e24af34dcc6750ad39f/route.go#L255

Describe alternatives you've considered

https://github.com/minio/minio/blob/master/cmd/api-router.go#L242

Additional context

No response

Code of Conduct

• [X] I agree to follow this project's Code of Conduct

Describe the pull request

Link to the issue: https://github.com/flamego/flamego/issues/113

Checklist

• [x] I agree to follow the Code of Conduct by submitting this pull request.
• [x] I have read and acknowledge the Contributing guide.
• [x] I have added test cases to cover the new code.

Followup

• [x] Update docs on flamego.dev
• [x] Update docs on flamego.cn

Component

Middleware

Middleware

https://github.com/flamego/validator

Is your feature request related to a problem? Please describe

The validator module should be able to work with github.com/go-i18n/i18n and github.com/flamego/i18n, we need to make some example or make code changes to make that happen.

Describe the solution you'd like

n/a

Describe alternatives you've considered

n/a

Additional context

No response

Code of Conduct

• [X] I agree to follow this project's Code of Conduct

Component

Core framework

Middleware

n/a

Is your feature request related to a problem? Please describe

Currently multiplex routes are supported via:

f.Routes("/", http.MethodGet, http.MethodPost, <my handlers>)

// or

f.Routes("/", "GET,POST", ...)

But neither of are both elegant and type-safe.

Describe the solution you'd like

Something like

f.RoutePath("/").Methods(http.MethodGet, http.MethodPost).Handlers(...)

Describe alternatives you've considered

Live with it

Additional context

Derived from https://github.com/flamego/flamego/issues/113#issuecomment-1125895280

Code of Conduct

• [X] I agree to follow this project's Code of Conduct

What needs to be improved? Please describe

• [ ] Add both English and Chinese versions of SSE middleware.

Update links to the docs on:

• [ ] The "Middleware" section on the main repository's README
• [ ] The "Getting help" section on each middleware repository's README
• [ ] flamego.dev/middleware

Why do you think it is important?

This is a new middleware for Flamego.

It was implemented in "dependency injection style" which is much different from the other Go web frameworks.

So it's necessary for us to provide documentation for developers.

Code of Conduct

• [X] I agree to follow this project's Code of Conduct

Component

Middleware

Middleware

https://github.com/flamego/template

Version

1.0.0

Describe the bug

Occasionally seeing logs of "failed to write out rendered HTML: short write" printed to console.

To reproduce

Running https://github.com/asoul-sig/asouldocs for https://asouldocs.dev

Expected behavior

Not sure, is this a real error or should just be ignored? Maybe something wrong with the response body content length?

Additional context

Related: https://github.com/denoland/deno/issues/3478#issuecomment-564406922

Code of Conduct

• [X] I agree to follow this project's Code of Conduct

Component

Core framework

Middleware

n/a

Version

1.1.0

Describe the bug

As the document mentioned, the RemoteAddr() method looks at the following things in the order to determine which one is more likely to contain the real client address.

The X-Real-IP request header The X-Forwarded-For request header The http.Request.RemoteAddr field

So the client's IP can be spoofed by setting the X-Real-IP or X-Forwarded-For header when the Flamego server is exposed directly to the internet.

The Gin web framework has the same vulnerability before, check CVE-2020-28483 for details.

I think we should create a new function called ClientIP() to get the client IP address from these headers. The RemoteAddr() can only get it from http.Request.RemoteAddr.

Moreover, the Flame instance should allow the developers to set the trusted remote IP headers and the trusted proxies if they want to get the client IP from user-provided headers.

To reproduce

n/a

Expected behavior

n/a

Additional context

https://nvd.nist.gov/vuln/detail/CVE-2020-28483 https://github.com/gin-gonic/gin/issues/2473

Code of Conduct

• [X] I agree to follow this project's Code of Conduct

Component

Middleware

Middleware

https://github.com/zhqqqy/flamego-limit

Is your feature request related to a problem? Please describe

Web frameworks generally need the function of current limiting.

Describe the solution you'd like

I implemented a simple current limiting middleware based on the sliding window algorithm, which can be enabled in the specified router, and the current limiting key can be customized.

Describe alternatives you've considered

It may also be possible to implement current limiting algorithms such as token buckets based on this

Additional context

No response

Code of Conduct

• [X] I agree to follow this project's Code of Conduct

GitHub Actions now supports reusable workflows, which seems perfect for Go lint, unit tests and LSIF as configurations of these jobs are identical in almost all repositories.

• https://github.blog/changelog/2022-05-03-github-actions-simplify-using-secrets-with-reusable-workflows/