Go Authentication Design Patterns

badAuthPattern.go

package main

import (
        "log"
        "net/http"
        "os"

        "github.com/gorilla/sessions"
)

var store = sessions.NewCookieStore([]byte(os.Getenv("SESSION-INTEGRITY")))

func authenticated(w http.ResponseWriter, r *http.Request) {
        if session, err := store.Get(r, "SESSIONID"); err == nil {
                if _, ok := session.Values["loggedin"]; !ok {
                                w.WriteHeader(http.StatusUnauthorized)
                                return
                }

                w.Write([]byte("Why yes, you are logged in!"))

        } else {
                w.WriteHeader(http.StatusInternalServerError)
        }
}
func main() {
        http.HandleFunc("/authenticated", authenticated)
        log.Fatal(http.ListenAndServe(":8080", nil))
}