Go net/http

Before you start

A firewall integration enforces the signed policy bundle of your site in front of your origin: block, redirect, challenge and token-gated routes. It fetches the bundle from GET /v1/policies/<site key>, verifies its signature offline and decides every request the same way in every language. It does not replace verifying tokens in your own code. A request that reaches your origin another way (a direct IP, another hostname, a path the integration was not installed on) is never evaluated, so let only the integration reach the origin. See firewall policies.

The secret key (rgsk_...) is needed only for requireToken rules. Without it such a rule applies its onError setting.

Install and mount

Module github.com/revokegpt/revokegpt-go/firewall (standard library only). Wrap the whole mux, not a route inside it: http.ServeMux cleans the path and redirects // and dot segments before your handler runs, so a firewall mounted inside the mux would never see the raw target. The firewall matches on r.RequestURI.

main.go

package main

import (
  "log"
  "net/http"

  "github.com/revokegpt/revokegpt-go/firewall"
)

func main() {
  fw, err := firewall.New(firewall.Config{
    SiteKey:   "rgpk_...",
    SecretKey: "rgsk_...", // needed for requireToken rules
  })
  if err != nil {
    log.Fatal(err)
  }
  mux := http.NewServeMux()
  // ... routes ...
  // Wrap the whole mux: http.ServeMux cleans the path before a handler inside it runs.
  log.Fatal(http.ListenAndServe(":8080", fw.Middleware(mux)))
}

Not published yet

This integration package is built and tested in the repository but not published to its registry yet. Install it from a checkout until the first release.

Keep routing case-sensitive

Firewall rules match paths case-sensitively, so /ADMIN is not /admin. If your origin routes case-insensitively (IIS, a case-folding proxy or framework), /ADMIN can reach the /admin handler while a rule on /admin never sees it. Make the origin case-sensitive, or write a rule for each spelling it serves.