Feature/challenge 5 — HTTP Authentication Middleware #859
Conversation
WalkthroughThis PR adds a complete solution for Challenge 1 with a Changes
Estimated code review effort🎯 2 (Simple) | ⏱️ ~8 minutes Both changes implement straightforward logic without complex control flow or error paths. Challenge 1 is basic arithmetic and input parsing; Challenge 5 is standard HTTP header validation middleware. Limited scope with consistent, homogeneous additions. Possibly related PRs
Pre-merge checks❌ Failed checks (1 warning)
✅ Passed checks (2 passed)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
📜 Review details
Configuration used: CodeRabbit UI
Review profile: CHILL
Plan: Pro
📒 Files selected for processing (2)
challenge-1/submissions/brenoamin/solution-template.go(1 hunks)challenge-5/solution-template.go(2 hunks)
🔇 Additional comments (2)
challenge-5/solution-template.go (1)
53-59: Good improvement to error handling.Properly handling and logging the error from
ListenAndServeimproves debuggability when the server fails to start.challenge-1/submissions/brenoamin/solution-template.go (1)
1-24: LGTM!The implementation is straightforward and correct. The
Sumfunction properly adds two integers, and themainfunction handles input reading with appropriate error checking.
| func AuthMiddleware(next http.Handler) http.Handler { | ||
| return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) { | ||
| // TODO: Implement the logic: | ||
| // 1) Grab the "X-Auth-Token" header | ||
| // 2) Compare against validToken | ||
| // 3) If mismatch or missing, respond with 401 | ||
| // 4) Otherwise pass to next handler | ||
| authHeader := r.Header.Get("X-Auth-Token") | ||
| if authHeader == "" { | ||
| w.WriteHeader(http.StatusUnauthorized) | ||
| return | ||
| } | ||
|
|
||
| if authHeader == validToken { | ||
| next.ServeHTTP(w, r) | ||
| } | ||
| w.WriteHeader(http.StatusUnauthorized) | ||
| }) | ||
| } |
There was a problem hiding this comment.
Critical logic error: 401 sent even for valid tokens.
Line 24 executes unconditionally after the if block at lines 21-23, which means w.WriteHeader(http.StatusUnauthorized) is called even when the token is valid and next.ServeHTTP(w, r) has already been invoked. This corrupts the response for authorized requests.
Apply this diff to fix the logic:
func AuthMiddleware(next http.Handler) http.Handler {
return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
authHeader := r.Header.Get("X-Auth-Token")
if authHeader == "" {
w.WriteHeader(http.StatusUnauthorized)
return
}
if authHeader == validToken {
next.ServeHTTP(w, r)
+ return
}
w.WriteHeader(http.StatusUnauthorized)
})
}📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
| func AuthMiddleware(next http.Handler) http.Handler { | |
| return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) { | |
| // TODO: Implement the logic: | |
| // 1) Grab the "X-Auth-Token" header | |
| // 2) Compare against validToken | |
| // 3) If mismatch or missing, respond with 401 | |
| // 4) Otherwise pass to next handler | |
| authHeader := r.Header.Get("X-Auth-Token") | |
| if authHeader == "" { | |
| w.WriteHeader(http.StatusUnauthorized) | |
| return | |
| } | |
| if authHeader == validToken { | |
| next.ServeHTTP(w, r) | |
| } | |
| w.WriteHeader(http.StatusUnauthorized) | |
| }) | |
| } | |
| func AuthMiddleware(next http.Handler) http.Handler { | |
| return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) { | |
| authHeader := r.Header.Get("X-Auth-Token") | |
| if authHeader == "" { | |
| w.WriteHeader(http.StatusUnauthorized) | |
| return | |
| } | |
| if authHeader == validToken { | |
| next.ServeHTTP(w, r) | |
| return | |
| } | |
| w.WriteHeader(http.StatusUnauthorized) | |
| }) | |
| } |
🤖 Prompt for AI Agents
In challenge-5/solution-template.go around lines 13 to 26 the middleware
unconditionally calls w.WriteHeader(http.StatusUnauthorized) after the
valid-token branch, causing a 401 to be sent even for authorized requests; fix
it by ensuring the function returns immediately after calling next.ServeHTTP for
a valid token (or restructure the conditional with an else), so the unauthorized
header is only written when the token is missing or invalid.
1 participant
This challenge implements a simple HTTP authentication middleware in Go. The middleware intercepts incoming requests and validates the
"X-Auth-Token"header before allowing access to protected routes.What was required
X-Auth-Tokenheader."secret".GET /hello→ returns "Hello!"GET /secure→ returns "You are authorized!" only with a valid token.The challenge includes test cases covering valid tokens, missing headers, invalid values, and correct routing behavior.