内置中间件 #

e := echo.New()
e.Use(middleware.Logger())

e.Use(middleware.LoggerWithConfig(middleware.LoggerConfig{
    Format: "time=${time_rfc3339}, method=${method}, uri=${uri}, status=${status}, latency=${latency_human}\n",
}))

file, err := os.OpenFile("logs/app.log", os.O_CREATE|os.O_WRONLY|os.O_APPEND, 0644)
if err != nil {
    panic(err)
}

e.Use(middleware.LoggerWithConfig(middleware.LoggerConfig{
    Output: file,
}))

e.Use(middleware.LoggerWithConfig(middleware.LoggerConfig{
    Skipper: func(c echo.Context) bool {
        return c.Path() == "/health" || c.Path() == "/metrics"
    },
}))

e.Use(middleware.Recover())

e.Use(middleware.RecoverWithConfig(middleware.RecoverConfig{
    DisablePrintStack: false,
    LogLevel:          1,
    LogErrorFunc: func(c echo.Context, err error, stack []byte) error {
        log.Printf("Panic: %v\n%s", err, stack)
        return nil
    },
}))

e.Use(middleware.CORS())

e.Use(middleware.CORSWithConfig(middleware.CORSConfig{
    AllowOrigins: []string{"https://example.com", "https://api.example.com"},
    AllowMethods: []string{echo.GET, echo.POST, echo.PUT, echo.DELETE, echo.PATCH},
    AllowHeaders: []string{
        echo.HeaderOrigin,
        echo.HeaderContentType,
        echo.HeaderAccept,
        echo.HeaderAuthorization,
    },
    AllowCredentials: true,
    MaxAge:           3600,
}))

e.Use(middleware.CORSWithConfig(middleware.CORSConfig{
    AllowOriginFunc: func(origin string) (bool, error) {
        return strings.HasSuffix(origin, ".example.com"), nil
    },
}))

e.Use(middleware.Gzip())

e.Use(middleware.GzipWithConfig(middleware.GzipConfig{
    Level: 5,
    Skipper: func(c echo.Context) bool {
        return strings.Contains(c.Request().URL.Path, "metrics")
    },
}))

e.Use(middleware.JWT([]byte("secret")))

e.Use(middleware.JWTWithConfig(middleware.JWTConfig{
    SigningKey:  []byte("secret"),
    TokenLookup: "header:Authorization:Bearer ",
    AuthScheme:  "Bearer",
    ContextKey:  "user",
}))

e.GET("/profile", func(c echo.Context) error {
    user := c.Get("user").(*jwt.Token)
    claims := user.Claims.(jwt.MapClaims)
    name := claims["name"].(string)
    
    return c.String(http.StatusOK, "Welcome "+name)
}, middleware.JWT([]byte("secret")))

// 从Header获取
TokenLookup: "header:Authorization:Bearer "

// 从Query参数获取
TokenLookup: "query:token"

// 从Cookie获取
TokenLookup: "cookie:jwt"

// 从多个位置获取
TokenLookup: "header:Authorization:Bearer ,query:token"

e.Use(middleware.BasicAuth(func(username, password string, c echo.Context) (bool, error) {
    if username == "admin" && password == "secret" {
        return true, nil
    }
    return false, nil
}))

e.Use(middleware.BasicAuth(func(username, password string, c echo.Context) (bool, error) {
    user, err := getUserByUsername(username)
    if err != nil {
        return false, nil
    }
    
    if err := bcrypt.CompareHashAndPassword([]byte(user.Password), []byte(password)); err != nil {
        return false, nil
    }
    
    c.Set("user", user)
    return true, nil
}))

e.Use(middleware.RateLimiter(middleware.NewRateLimiterMemoryStore(20)))

e.Use(middleware.RateLimiterWithConfig(middleware.RateLimiterConfig{
    Store: middleware.NewRateLimiterMemoryStoreWithConfig(
        middleware.RateLimiterMemoryStoreConfig{Rate: 10, Burst: 30, ExpiresIn: 3 * time.Minute},
    ),
    IdentifierExtractor: func(ctx echo.Context) (string, error) {
        id := ctx.RealIP()
        return id, nil
    },
    ErrorHandler: func(context echo.Context, err error) error {
        return context.JSON(http.StatusTooManyRequests, map[string]string{
            "error": "请求过于频繁",
        })
    },
}))

e.Use(middleware.RateLimiterWithConfig(middleware.RateLimiterConfig{
    Store: middleware.NewRateLimiterMemoryStore(10),
    IdentifierExtractor: func(ctx echo.Context) (string, error) {
        if user := ctx.Get("user"); user != nil {
            return user.(*User).ID, nil
        }
        return ctx.RealIP(), nil
    },
}))

e.Use(middleware.RequestID())

e.GET("/", func(c echo.Context) error {
    requestID := c.Response().Header().Get(echo.HeaderXRequestID)
    return c.String(http.StatusOK, "Request ID: "+requestID)
})

e.Use(middleware.RequestIDWithConfig(middleware.RequestIDConfig{
    Generator: func() string {
        return uuid.New().String()
    },
}))

e.Use(middleware.Secure())

e.Use(middleware.SecureWithConfig(middleware.SecureConfig{
    XSSProtection:         "1; mode=block",
    ContentTypeNosniff:    "nosniff",
    XFrameOptions:         "DENY",
    HSTSMaxAge:            3600,
    ContentSecurityPolicy: "default-src 'self'",
}))

e.Use(middleware.BodyLimit("2M"))

e.POST("/upload", uploadHandler, middleware.BodyLimit("10M"))

e.Use(middleware.CSRF())

e.Use(middleware.CSRFWithConfig(middleware.CSRFConfig{
    TokenLookup: "form:_csrf",
    ContextKey:  "csrf",
    CookieName:  "_csrf",
    Cookie: &http.Cookie{
        Path:     "/",
        Secure:   true,
        HttpOnly: true,
    },
}))

e.GET("/form", func(c echo.Context) error {
    csrf := c.Get("csrf").(string)
    return c.HTML(http.StatusOK, fmt.Sprintf(`
        <form method="POST" action="/submit">
            <input type="hidden" name="_csrf" value="%s">
            <input type="text" name="name">
            <button type="submit">Submit</button>
        </form>
    `, csrf))
}, middleware.CSRF())

e.Use(middleware.TimeoutWithConfig(middleware.TimeoutConfig{
    Timeout: 30 * time.Second,
}))

e.Use(middleware.TimeoutWithConfig(middleware.TimeoutConfig{
    Timeout: 10 * time.Second,
    OnTimeoutRouteErrorHandler: func(err error, c echo.Context) error {
        return c.JSON(http.StatusRequestTimeout, map[string]string{
            "error": "请求超时",
        })
    },
}))

package main

import (
    "net/http"
    "time"
    "github.com/labstack/echo/v4"
    "github.com/labstack/echo/v4/middleware"
)

func main() {
    e := echo.New()
    
    e.Use(middleware.RequestID())
    e.Use(middleware.Recover())
    e.Use(middleware.Logger())
    e.Use(middleware.Gzip())
    e.Use(middleware.Secure())
    e.Use(middleware.CORSWithConfig(middleware.CORSConfig{
        AllowOrigins: []string{"*"},
        AllowMethods: []string{echo.GET, echo.POST, echo.PUT, echo.DELETE},
    }))
    e.Use(middleware.RateLimiter(middleware.NewRateLimiterMemoryStore(100)))
    
    e.GET("/health", health)
    
    api := e.Group("/api")
    api.Use(middleware.JWT([]byte("secret")))
    
    api.GET("/users", getUsers)
    api.GET("/profile", getProfile)
    
    admin := e.Group("/admin")
    admin.Use(middleware.BasicAuth(func(username, password string, c echo.Context) (bool, error) {
        if username == "admin" && password == "secret" {
            return true, nil
        }
        return false, nil
    }))
    
    admin.GET("/stats", getStats)
    
    e.Logger.Fatal(e.Start(":8080"))
}

func health(c echo.Context) error {
    return c.JSON(http.StatusOK, map[string]string{
        "status": "healthy",
        "time":   time.Now().Format(time.RFC3339),
    })
}

func getUsers(c echo.Context) error {
    return c.JSON(http.StatusOK, []map[string]string{
        {"id": "1", "name": "张三"},
        {"id": "2", "name": "李四"},
    })
}

func getProfile(c echo.Context) error {
    return c.JSON(http.StatusOK, map[string]string{
        "id":   "1",
        "name": "张三",
    })
}

func getStats(c echo.Context) error {
    return c.JSON(http.StatusOK, map[string]int{
        "users":  100,
        "posts":  500,
        "visits": 10000,
    })
}