Commit Graph

37 Commits (0379cc59aad033df2a73d25d8e3b870abe96a55a)

Author SHA1 Message Date
Juan Calderon-Perez 0379cc59aa
fix: Inconsistent and flaky unit-tests (#2892)
* Fixes for some of the failing tests

* Add readiness check to serverStart()

* Use net/http client for tests listen test

* Use different key for this test

* Run Proxy Middleware tests in parallel. Add nil checks for potential issues pointed by nilaway

* Enable parallel client tests

* Do not run timing sensitive tests in parallel

* Remove TODO

* Revert Test_Proxy_DoTimeout_Timeout, and remove t.Parallel() for it

* Do not calculate favicon len on each handler call

* Revert logic change

* Increase timeout of SaveFile tests

* Do not run time sensitive tests in parallel

* The Agent can't be run in parallel

* Do not run time sensitive tests in parallel

* Fixes based on uber/nilaway

* Revert change to Client test

* Run parallel

* Update client_test.go

* Update client_test.go

* Update cache_test.go

* Update cookiejar_test.go

* Remove parallel for test using timeouts

* Remove t.Parallel() from logger middleware tests

* Do not use testify.require in a goroutine

* Fix import, and update golangci-lint

* Remove changes to template_chain.go

* Run more tests in parallel

* Add more parallel tests

* Add more parallel tests

* SetLogger can't run in parallel

* Run more tests in parallel, fix issue with goroutine in limiter middleware

* Update internal/storage/memory, add more benchmarks

* Increase sleep for csrf test by 100 milliseconds. Implement asserted and parallel benchmarks for Session middleware

* Add 100 milliseconds to sleep during test

* Revert name change

* fix: Inconsistent and flaky unit-tests

* fix: Inconsistent and flaky unit-tests

* fix: Inconsistent and flaky unit-tests

* fix: Inconsistent and flaky unit-tests

* fix: Inconsistent and flaky unit-tests

* fix: Inconsistent and flaky unit-tests

* fix: Inconsistent and flaky unit-tests

* fix: Inconsistent and flaky unit-tests

* fix: Inconsistent and flaky unit-tests

* fix: Inconsistent and flaky unit-tests

---------

Co-authored-by: M. Efe Çetin <efectn@protonmail.com>
Co-authored-by: René <rene@gofiber.io>
2024-03-08 20:03:13 +01:00
RW ec48a76f14
V2 to v3 merge (#2864)
* Update pull_request_template.md

* Update v3-changes.md

* Update CONTRIBUTING.md (#2752)

Grammar correction.

* chore(encryptcookie)!: update default config (#2753)

* chore(encryptcookie)!: update default config

docs(encryptcookie): enhance documentation and examples

BREAKING CHANGE: removed the hardcoded "csrf_" from the Except.

* docs(encryptcookie): reads or modifies cookies

* chore(encryptcookie): csrf config example

* docs(encryptcookie): md table spacing

* build(deps): bump actions/setup-go from 4 to 5 (#2754)

Bumps [actions/setup-go](https://github.com/actions/setup-go) from 4 to 5.
- [Release notes](https://github.com/actions/setup-go/releases)
- [Commits](https://github.com/actions/setup-go/compare/v4...v5)

---
updated-dependencies:
- dependency-name: actions/setup-go
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

* 🩹 middleware/logger/: log client IP address by default (#2755)

* middleware/logger: Log client IP address by default.

* Update doc.

* fix: don't constrain middlewares' context-keys to strings 🐛 (#2751)

* Revert "Revert "🐛 requestid.Config.ContextKey is interface{} (#2369)" (#2742)"

This reverts commit 28be17f929.

* fix: request ContextKey default value condition

Should check for `nil` since it is `any`.

* fix: don't constrain middlewares' context-keys to strings

`context` recommends using "unexported type" as context keys to avoid
collisions https://pkg.go.dev/github.com/gofiber/fiber/v2#Ctx.Locals.

The official go blog also recommends this https://go.dev/blog/context.

`fiber.Ctx.Locals(key any, value any)` correctly allows consumers to
use unexported types or e.g. strings.

But some fiber middlewares constrain their context-keys to `string` in
their "default config structs", making it impossible to use unexported
types.

This PR removes the `string` _constraint_ from all middlewares, allowing
to now use unexported types as per the official guidelines. However
the default value is still a string, so it's not a breaking change, and
anyone still using strings as context keys is not affected.

* 📚 Update app.md for indentation (#2761)

Update app.md for indentation

* build(deps): bump github.com/google/uuid from 1.4.0 to 1.5.0 (#2762)

Bumps [github.com/google/uuid](https://github.com/google/uuid) from 1.4.0 to 1.5.0.
- [Release notes](https://github.com/google/uuid/releases)
- [Changelog](https://github.com/google/uuid/blob/master/CHANGELOG.md)
- [Commits](https://github.com/google/uuid/compare/v1.4.0...v1.5.0)

---
updated-dependencies:
- dependency-name: github.com/google/uuid
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

* build(deps): bump github/codeql-action from 2 to 3 (#2763)

Bumps [github/codeql-action](https://github.com/github/codeql-action) from 2 to 3.
- [Release notes](https://github.com/github/codeql-action/releases)
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md)
- [Commits](https://github.com/github/codeql-action/compare/v2...v3)

---
updated-dependencies:
- dependency-name: github/codeql-action
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

* Changing default log output (#2730)

changing default log output

Closes #2729

* Update hooks.md

fix wrong hooks signature

* 🩹 Fix: CORS middleware should use the defined AllowedOriginsFunc config when AllowedOrigins is empty (#2771)

* 🐛 [Bug]: Adaptator + otelfiber issue #2641 (#2772)

* 🩹🚨 - fix for redirect with query params (#2748)

* redirect with query params did not work, fix it and add test for it

* redirect middleware - fix test typo

* ♻️ logger/middleware colorize logger error message #2593 (#2773)

*  feat: add liveness and readiness checks (#2509)

*  feat: add liveness and readiness checkers

* 📝 docs: add docs for liveness and readiness

*  feat: add options method for probe checkers

*  tests: add tests for liveness and readiness

* ♻️ refactor: change default endpoint values

* ♻️ refactor: change default value for liveness endpoint

* 📝 docs: add return status for liveness and readiness probes

* ♻️ refactor: change probechecker to middleware

* 📝 docs: move docs to middleware session

* ♻️ refactor: apply gofumpt formatting

* ♻️ refactor: remove unused parameter

* split config and apply a review

* apply reviews and add testcases

* add benchmark

* cleanup

* rename middleware

* fix linter

* Update docs and config values

* Revert change to IsReady

* Updates based on code review

* Update docs to match other middlewares

---------

Co-authored-by: Muhammed Efe Cetin <efectn@protonmail.com>
Co-authored-by: Juan Calderon-Perez <835733+gaby@users.noreply.github.com>
Co-authored-by: Juan Calderon-Perez <jgcalderonperez@protonmail.com>

* prepare release v2.52.0
- add more Parser tests

* fix healthcheck.md

* configure workflows for V2 branch

* configure workflows for V2 branch

* Fix default value to false in docs of QueryBool (#2811)

fix default value to false in docs of QueryBool

* update queryParser config

* Update ctx.md

* Update routing.md

* merge v2 in v3

* merge v2 in v3

* lint fixes

* 📚 Doc: Fix code snippet indentation in /docs/api/middleware/keyauth.md

Removes an an extra level of indentation in line 51 of
`keyauth.md` [here](https://github.com/gofiber/fiber/blob/v2/docs/api/middleware/keyauth.md?plain=1#L51)

* fix: healthcheck middleware not working with route group (#2863)

* fix: healthcheck middleware not working with route group

* perf: change verification method to improve perf

* Update healthcheck_test.go

* test: add not matching route test for strict routing

* add more test cases

* correct tests

* correct test helpers

* correct tests

* correct tests

---------

Co-authored-by: Juan Calderon-Perez <835733+gaby@users.noreply.github.com>
Co-authored-by: René Werner <rene@gofiber.io>

* merge v2 in v3

* Merge pull request from GHSA-fmg4-x8pw-hjhg

* Enforce Wildcard Origins with AllowCredentials check

* Expand unit-tests, fix issues with subdomains logic, update docs

* Update cors.md

* Added test using localhost, ipv4, and ipv6 address

* improve documentation markdown

---------

Co-authored-by: René Werner <rene@gofiber.io>

* Update app.go

prepare release v2.52.1

* fix cors domain normalize

* fix sync-docs workflow

* test: fix failing tests

* fix sync-docs workflow

* test: cors middleware use testify require

* chore: fix lint warnings

* chore: revert test isolation.

* fixed the fasthttp ctx race condition problem

* Update middleware/cors/utils.go

Co-authored-by: Renan Bastos <renanbastos.tec@gmail.com>

* fix sync_docs.sh

* fix review comments/hints

* fix review comments/hints

* stabilize Test_Proxy_Timeout_Slow_Server test

* stabilize Test_Proxy_.* tests

* ignore bodyclose linter for tests
use http.NoBody instead of nil

* revert(tests): undo http.NoBody usage

* fix(ctx pool): postpone the reset for some values

shortly before the release in the pool

* refactor(tests): use testify panic method instead of custom solution

---------

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: tokelo-12 <113810058+tokelo-12@users.noreply.github.com>
Co-authored-by: Jason McNeil <sixcolors@mac.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: iRedMail <2048991+iredmail@users.noreply.github.com>
Co-authored-by: Benjamin Grosse <ste3ls@gmail.com>
Co-authored-by: Mehmet Firat KOMURCU <mehmetfiratkomurcu@hotmail.com>
Co-authored-by: Bruno <bdm2943@icloud.com>
Co-authored-by: Muhammad Kholid B <muhammadkholidb@gmail.com>
Co-authored-by: gilwo <gilwo@users.noreply.github.com>
Co-authored-by: Lucas Lemos <lucashenriqueblemos@gmail.com>
Co-authored-by: Muhammed Efe Cetin <efectn@protonmail.com>
Co-authored-by: Juan Calderon-Perez <835733+gaby@users.noreply.github.com>
Co-authored-by: Juan Calderon-Perez <jgcalderonperez@protonmail.com>
Co-authored-by: Jongmin Kim <kjongmin26@gmail.com>
Co-authored-by: Giovanni Rivera <rivera.giovanni271@gmail.com>
Co-authored-by: Renan Bastos <renanbastos.tec@gmail.com>
2024-02-29 08:29:59 +01:00
nickajacks1 827013d789
chore: Fix testifylint errors in middleware (#2805) 2024-01-21 08:32:23 +01:00
Muhammed Efe Cetin 1588b6b602
Merge remote-tracking branch 'origin/master' 2024-01-13 18:26:07 +03:00
Jason McNeil 2954e3bbae
♻️ v3: fix!: ContextKey collisions (#2781)
* fix: ContextKey collisions

* fix(logger): lint error

* docs(csrf): fix potential range error in example
2024-01-04 09:44:45 +01:00
nickajacks1 eeced206ed
test: Fix failing CSRF tests (#2720)
 test: fix failing csrf test

A test validating that expired tokens fail was hitting a race condition
with garbage collection. Sometimes, an assertion that expects memory
storage GC to have triggered happens too quickly, causing the assertion
to fail. Give the GC a little bit more time to process before asserting.
2023-11-22 19:21:30 +01:00
Jason McNeil 2374cad3cd
📄 docs: improve csrf docs (#2726)
* docs: improve csrf docs

- fix issues with `X-Csrf-Token` capitalization inconsistency.
- reduce redundancy and repetition.
- improve grammar.

* docs: update middleware description

* docs: within vs in

* docs: deleting tokens

* docs: MUST

* docs: add colon

* docs: all modern browsers

* docs: patterns

* docs: improve phrasing of pattern options
2023-11-16 12:34:31 +01:00
Muhammed Efe Cetin 6ea4d81331
Merge branch 'master' into v3-beta 2023-11-07 20:22:31 +03:00
Jason McNeil 8c3916dbf4
Merge pull request from GHSA-94w9-97p3-p368
* feat: improved csrf with session support

* fix: double submit cookie

* feat: add warning cookie extractor without session

* feat: add warning CsrfFromCookie SameSite

* fix: use byes.Equal instead

* fix: Overriden CookieName KeyLookup cookie:<name>

* feat: Create helpers.go

* feat: use compareTokens (constant time compare)

* feat: validate cookie to prevent token injection

* refactor: clean up csrf.go

* docs: update comment about Double Submit Cookie

* docs: update docs for CSRF changes

* feat: add DeleteToken

* refactor: no else

* test: add more tests

* refactor: re-order tests

* docs: update safe methods RCF add note

* test: add CSRF_Cookie_Injection_Exploit

* feat: add SingleUseToken config

* test: check for new token

* docs: use warning

* fix: always register type Token

* feat: use UUIDv4

* test: swap in UUIDv4 here too

* fix: raw token injection

* fix: merege error

* feat: Sentinel errors

* chore: rename test

* fix: url parse

* test: add path to referer

* test: add expiration tests

* docs: add cookie prefix note

* docs: fix typo

* docs: add warning for refer checks

* test: add referer edge cases

And call ctx.Request.Reset() and
ctx.Response.Reset() before re-using ctx.
2023-10-16 09:06:30 +02:00
Jason McNeil b50d91d58e
Merge pull request from GHSA-94w9-97p3-p368
* feat: improved csrf with session support

* fix: double submit cookie

* feat: add warning cookie extractor without session

* feat: add warning CsrfFromCookie SameSite

* fix: use byes.Equal instead

* fix: Overriden CookieName KeyLookup cookie:<name>

* feat: Create helpers.go

* feat: use compareTokens (constant time compare)

* feat: validate cookie to prevent token injection

* refactor: clean up csrf.go

* docs: update comment about Double Submit Cookie

* docs: update docs for CSRF changes

* feat: add DeleteToken

* refactor: no else

* test: add more tests

* refactor: re-order tests

* docs: update safe methods RCF add note

* test: add CSRF_Cookie_Injection_Exploit

* feat: add SingleUseToken config

* test: check for new token

* docs: use warning

* fix: always register type Token

* feat: use UUIDv4

* test: swap in UUIDv4 here too
2023-10-11 14:41:42 +02:00
Muhammed Efe Çetin 088cde594d
Merge remote-tracking branch 'origin/master' into v3-beta 2023-02-05 23:43:42 +03:00
leonklingele 167a8b5e94
🚀 Feature: Add and apply more stricter golangci-lint linting rules (#2286)
* golangci-lint: add and apply more stricter linting rules

* github: drop security workflow now that we use gosec linter inside golangci-lint

* github: use official golangci-lint CI linter

* Add editorconfig and gitattributes file
2023-01-27 09:01:37 +01:00
M. Efe Çetin 5406560033
🧹 chore: make most tests parallel (#2299)
* 🧹 chore: make most tests parallel

* revert some tests

* revert some tests

* revert some tests
2023-01-15 23:21:37 +08:00
Kris Carr f26d9b1d4e
v3 (deps): update to use gofiber/utils/v2 (#2184) 2022-10-31 16:44:53 +03:00
Muhammed Efe Çetin ca6f25a890
v3 (deps): move `utils` to `https://github.com/gofiber/utils` 2022-09-23 21:19:44 +03:00
Muhammed Efe Çetin 319b8ea3a8
Merge remote-tracking branch 'origin/master' into v3-beta 2022-09-03 23:56:45 +03:00
RW ec96d161a0
Fix csrf middleware behavior with header key lookup (#2063)
* 🐛 [Bug]: Strange CSRF middleware behavior with header KeyLookup configuration #2045
2022-08-30 14:48:31 +02:00
Jason McNeil 6272d759eb
🚀 [Feature]: middleware/csrf custom extractor (#2052)
* feat(middleware/csrf): allow custom Extractor

* test: update Test_CSRF_From_Custom

* docs: add comma

* docs: update KeyLookup docs
2022-08-28 18:57:47 +02:00
Trim21 c964fda009
v3(tests): use testify for assertion (#2036)
* replace

* write

* rewrite more

* rewrite

* rewrite

* fix

* rewrite
2022-08-22 07:57:10 +02:00
M. Efe Çetin a458bd344c
v3 (feature): convert fiber.Ctx type to interface (#1928)
*  v3: convert fiber.Ctx type to interface

* update ctx methods

* add new methods to customize ctx, fix some problems

* update comments.

* fix something
2022-07-13 07:48:29 +02:00
Muhammed Efe Çetin 1188144d78
🎉 v3: init 2022-05-31 17:35:49 +03:00
Jason McNeil 59e4bf6cc5
🔧 fix(middleware/csrf): unmatched token returns nil error (#1667)
* Update csrf.go

* Update csrf_test.go

* fix(middleware/csrf): missing token return and unit test

* Update csrf_test.go
2021-12-29 02:13:20 +01:00
Gusted 7b7dcf29f7
♻️ Tidy up the codebase (#1613)
* run gofmt

* add t.Helper()

* Simplify assigns

* Simplify make operation

* Remove unused field in struct

* Fix typo

* Run gofumpt ./

* Consistent spacing

* len(...) can never be negative

* Use ReplaceAll

* Simplify operation

* Remove deadcode

* Fix typo

* Tidy up `} else { if ...`

* Fix AssertEqual

* Remove t.Helper() to fix go1.14.15
2021-11-05 08:00:03 +01:00
Jason McNeil 53e5dc523e
🩹 Fix: CSRF middleware cookie<>storage bug squashed and other improvements (#1180)
* expire cookie on Post, Delete, Patch and Put

Cookie should always expire on Post, Delete, Patch and Put as it is either valid and will be removed from storage, or is not in storage and invalid

* token and cookie match

* retrigger checks

* csrf tests

* csrf per session strategy
2021-03-01 17:44:17 +01:00
hinoguma 1ad5a618cb make default handler to private. fix testcase for invalid token and empty token. 2021-01-23 12:39:27 +09:00
hinoguma 19e6a4429d add custom error func for csrf middleware 2021-01-23 03:45:47 +09:00
Fenny ce897c0b66 🩹 fix tests 2020-11-11 18:34:46 +01:00
Fenny 053dfd383d 🩹 fix crsf middleware 2020-11-11 15:25:35 +01:00
Fenny 9f2c0691b0 🩹 fix test cases 2020-10-24 01:00:09 +02:00
kiyon 616ff8f532 👷 remove unnecessary fiber app config 2020-09-17 13:41:06 +08:00
kiyon 0ad36c7526 👷 improve csrf mw test cases
Co-authored-by: Rene rene@gofiber.io
2020-09-16 15:17:17 +08:00
kiyon 3cedf2dc3e 👷 improve csrf mw test cases 2020-09-16 11:15:10 +08:00
kiyon e13411e184 👷 improve mw test cases
add Next test case
2020-09-16 09:44:05 +08:00
Fenny 2768ea2a77 🙌 make utils public
Co-Authored-By: RW <7063188+ReneWerner87@users.noreply.github.com>
2020-09-14 12:12:29 +02:00
Fenny a3cac71ae8 🔦 move utils to internal 2020-09-14 09:09:06 +02:00
Fenny b8cb100e28 v2 2020-09-14 05:47:17 +02:00
Fenny ec5d66e7a8 v2 2020-09-13 11:20:11 +02:00