HTTP.jl 1.0.0+ & Middleware chaining

[ndortega]

Hi everyone,

I'd like to get some feedback on my latest PR which makes Oxygen compatible with HTTP.jl v1.0.0+. Upgrading the package forced me to make some changes to the internal API which brought in a couple of features like chaining middleware functions.

Middleware functions make it easy to create workflows to intercept all incoming requests and outgoing responses. Let's say you have a more complex web application, you'll probably need to add most of the following features:

• CORS
• authentication
• custom response transformer

Instead of copying and pasting the same code throughout all your routes, you could create middleware functions for each of these and call them in one place to have all requests & responses pass through them.

So now that we see why this might be helpful I wanted to get your input on the syntax of chaning these middleware functions

The serve() and serveparallel() functions have booth been updated to accept middleware functions like this:

serve(handler1, handler2, handler3)

In this example they would get executed in the order they were passed (handler1, handler2, and handler3). It's worth remembering you can still pass the same keywords as before, you just need to add in a semicolon to separate the middleware functions from the rest:

serve(handler1, handler2, handler3; port=8000)

Questions for you:

• Are these changes intuitive?
• Do you see any issues with the current syntax?

Below is a simplified example of what it would look like in action:

using Oxygen
using HTTP

@get "/divide/{a}/{b}" function(req::HTTP.Request, a::Float64, b::Float64)
    return a / b
end

function handler1(handler)
    return function(req::HTTP.Request)
        println("1")
        handler(req)
    end
end

function handler2(handler)
    return function(req::HTTP.Request)
        println("2")
        handler(req)
    end
end

function handler3(handler)
    return function(req::HTTP.Request)
        println("3")
        handler(req)
    end
end

serve(handler1, handler2, handler3)

[ndortega]

@HiperMaximus @jiachengzhang1
Here are the middleware changes that we were talking about a while back, let me know what you guys think

[jiachengzhang1]

also, a Discord channel is a great idea

[ndortega]

@jiachengzhang1
That's a great point, without route-specific middleware you'd have to add an explicit exception for each route in the middleware function. I found a similar point raised in the FastApi github repo: fastapi/fastapi#1174 (comment)

What if we add both:

• router-specific middleware
• route-specific middleware

using Oxygen

const CORS_HEADERS = [
    "Access-Control-Allow-Origin" => "*",
    "Access-Control-Allow-Headers" => "*",
    "Access-Control-Allow-Methods" => "POST, GET, OPTIONS"
]

# https://juliaweb.github.io/HTTP.jl/stable/examples/#Cors-Server
function CorsMiddleware(handler)
    return function(req::HTTP.Request)
        if HTTP.hasheader(req, "OPTIONS")
            return HTTP.Response(200, CORS_HEADERS)
        else 
            return handler(req)
        end
    end
end

function AuthMiddleware(handler)
    return function(req::HTTP.Request)
        # ** NOT an actual security check ** #
        if !HTTP.headercontains(req, "Authorization", "true")
            return HTTP.Response(403)
        else 
            return HTTP.Response(200, body=string(handler(req)))
        end
    end
end

# assign router-specific middleware (would overwrite and replace any global middleware)
math = router("/math", middleware=[CorsMiddleware])

# You could also assign route-specific middleware (this would be additive and would get executed after the router specific middleware)
# This endpoint would have both [CorsMiddleware, AuthMiddleware] applied to it
@get math("/multiply/{a}/{b}", middleware=[AuthMiddleware]) function(req, a::Float64, b::Float64)
    return a * b
end

# This endpoint would have only CorsMiddleware applied to it
@get math("/divide/{a}/{b}") function(req, a::Float64, b::Float64)
    return a / b
end

# both global middleware functions would get applied automatically
@get "/add/{a}/{b}" function(req, a::Float64, b::Float64)
    return a + b
end

serve([CorsMiddleware, AuthMiddleware])

[ndortega]

@HiperMaximus @jiachengzhang1
I'm not against creating a discord channel, both of you have sparked a lot of great ideas for this package. What would be the main purpose of the discord channel? Stuff like general help or Q&A?

Selfishly, I like using the github discussions page because googles' SEO algo see's the increased interaction and boosts the ranking when people search for julia & web-related things. But there's no actual reason why we can't have both

[HiperMaximus]

Well, discord is useful to chat directly with people that are interested in using the package, but what you say it's true. We can use the discussions to have more informal chats too, but I suppose it would be necessary to make it explicit in the readme as a lot of people don't feel as comfortable using GitHub for normal casual questions

[jiachengzhang1]

@jiachengzhang1 That's a great point, without route-specific middleware you'd have to add an explicit exception for each route in the middleware function. I found a similar point raised in the FastApi github repo: tiangolo/fastapi#1174 (comment)

What if we add both:

• router-specific middleware
• route-specific middleware

using Oxygen

const CORS_HEADERS = [
    "Access-Control-Allow-Origin" => "*",
    "Access-Control-Allow-Headers" => "*",
    "Access-Control-Allow-Methods" => "POST, GET, OPTIONS"
]

# https://juliaweb.github.io/HTTP.jl/stable/examples/#Cors-Server
function CorsMiddleware(handler)
    return function(req::HTTP.Request)
        if HTTP.hasheader(req, "OPTIONS")
            return HTTP.Response(200, CORS_HEADERS)
        else 
            return handler(req)
        end
    end
end

function AuthMiddleware(handler)
    return function(req::HTTP.Request)
        # ** NOT an actual security check ** #
        if !HTTP.headercontains(req, "Authorization", "true")
            return HTTP.Response(403)
        else 
            return HTTP.Response(200, body=string(handler(req)))
        end
    end
end

# assign router-specific middleware (would overwrite and replace any global middleware)
math = router("/math", middleware=[CorsMiddleware])

# You could also assign route-specific middleware (this would be additive and would get executed after the router specific middleware)
# This endpoint would have both [CorsMiddleware, AuthMiddleware] applied to it
@get math("/multiply/{a}/{b}", middleware=[AuthMiddleware]) function(req, a::Float64, b::Float64)
    return a * b
end

# This endpoint would have only CorsMiddleware applied to it
@get math("/divide/{a}/{b}") function(req, a::Float64, b::Float64)
    return a / b
end

# both global middleware functions would get applied automatically
@get "/add/{a}/{b}" function(req, a::Float64, b::Float64)
    return a + b
end

serve([CorsMiddleware, AuthMiddleware])

This solution looks great, I see the release, will test it out shortly!