How to write a response middleware

[JobberRT]

For example, I got a service that receives request from client, and decrypts its body, process the plain data, and then returns a encrypted response. I would like to use middlewares to implement this function.

For now, I can write a decrypt middleware just like normal middleware that works at "OnRequest-like" stage, but I don't know how to write a encrypt middleware that works at "OnResponse-likestage. To be more specify, it needs to work betweenhandlers have processed the data and return the plain responseandsend http response back to client`.

The full path I want is like this:
receive request --> decrypt middleware --> handler who process plain data and return response --> encrypt middleware --> send http response with encrypted body

[aldas]

@JobberRT do you want to build browser based encryption of body?

If not then maybe it would be easier to encrypt whole connection and use strict client certificate verification (tls.RequireAndVerifyClientCert). See https://smallstep.com/hello-mtls/doc/combined/go/go this way only clients with valid certificates can establish connection.

[aldas]

if it is only body then probably you can take https://github.com/labstack/echo/blob/master/middleware/body_dump.go middleware and create writer than encrypts responses and replace request body reader with something that decrypts into memory and replaces body.

reading https://groups.google.com/g/golang-nuts/c/fIOM5sZto0I point to this example that has streamWriter https://go.dev/play/p/4CX1J_IYqk

package main

import (
	"bytes"
	"compress/gzip"
	"crypto/aes"
	"crypto/cipher"
	"fmt"
	"io"
)

func main() {
	key := []byte("example key 1234")
	httpBody := bytes.NewBufferString("the body")

	block, err := aes.NewCipher(key)
	if err != nil {
		panic(err)
	}

	var iv [aes.BlockSize]byte
	stream := cipher.NewOFB(block, iv[:])

	output := &bytes.Buffer{}
	compress := gzip.NewWriter(output)

	writer := &cipher.StreamWriter{S: stream, W: compress}
	if _, err := io.Copy(writer, httpBody); err != nil {
		panic(err)
	}
	compress.Close()

	fmt.Printf("Bytes: %q\n", output.String())
}

that cipher has also StreamReader

	decompress, _ := gzip.NewReader(httpBody)
	reader := cipher.StreamReader{S: stream, R: decompress}

maybe this can be combined with something similar to gzip middleware?

nb: I have not tried this myself.

[JobberRT]

Thanks for reply, no, I'm not going to use it in the browser, this program is going to work as a API server.

I'm afraid of MITM attacking such as Charles or Proxyman or Fiddler, so encrypt the body is an additional security-bouns. I haven't learnt of strict client certificate verification yet, and don't know if this feature can avoid MITM attack, I'll check it and give it a try. If it's working, I'll mark your reply as answer, otherwise I will reply to you again. Thanks again for helping!

[aldas]

strict client certificate verification correct name is "mutual TLS" https://www.cloudflare.com/learning/access-management/what-is-mutual-tls/ and this is probably the thing you search.

[JobberRT]

Thanks! That's Great!!