Header

​

Overview

​

Installation

import "github.com/go-mizu/mizu/middlewares/header"

​

Quick Start

app := mizu.New()

// Set response header
app.Use(header.Set("X-Powered-By", "Mizu"))

​

Functions

​

Response Headers

​

Request Headers

​

Security Headers

​

Content Headers

​

Examples

​

Set Single Header

app.Use(header.Set("X-Custom-Header", "value"))

​

Set Multiple Headers

app.Use(header.New(map[string]string{
    "X-App-Name":    "MyApp",
    "X-App-Version": "1.0.0",
}))

​

Remove Headers

// Remove sensitive headers
app.Use(header.Remove("Server", "X-Powered-By"))

​

Security Headers

app.Use(header.XSSProtection())
app.Use(header.NoSniff())
app.Use(header.FrameDeny())

​

HSTS

app.Use(header.HSTS(31536000, true, true)) // 1 year, subdomains, preload

​

Content Security Policy

app.Use(header.CSP("default-src 'self'; script-src 'self' cdn.example.com"))

​

Full Configuration

app.Use(header.WithOptions(header.Options{
    Response: map[string]string{
        "X-Frame-Options":        "DENY",
        "X-Content-Type-Options": "nosniff",
    },
    ResponseRemove: []string{"Server"},
    Request: map[string]string{
        "X-Request-Source": "web",
    },
}))

​

API Reference

func Set(key, value string) mizu.Middleware
func SetRequest(key, value string) mizu.Middleware
func New(headers map[string]string) mizu.Middleware
func Remove(keys ...string) mizu.Middleware
func RemoveRequest(keys ...string) mizu.Middleware
func WithOptions(opts Options) mizu.Middleware

​

Technical Details

​

Architecture

​

Options Structure

type Options struct {
    Request        map[string]string // Request headers to set
    Response       map[string]string // Response headers to set
    RequestRemove  []string          // Request headers to remove
    ResponseRemove []string          // Response headers to remove
}

​

Execution Flow

1. Request Phase (before handler):
   • Sets request headers from Options.Request
   • Removes request headers from Options.RequestRemove
   • Sets response headers from Options.Response
2. Handler Execution: Calls the next middleware/handler
3. Response Phase (after handler):
   • Removes response headers from Options.ResponseRemove

​

Implementation Notes

• Request headers are set before the handler executes, making them available to downstream handlers
• Response headers are set before the handler but can be overridden by the handler
• Response header removal happens after the handler executes to ensure headers set by the handler are properly removed
• The middleware uses a custom itoa function for integer-to-string conversion to avoid unnecessary allocations in HSTS header generation

​

Best Practices

• Use WithOptions for complex configurations involving multiple header operations
• Use convenience functions (Set, Remove, etc.) for simple single-header operations
• Set security headers at the application level rather than per-route
• Remove sensitive headers (e.g., Server, X-Powered-By) to avoid information disclosure
• Chain multiple header middlewares when you need different headers for different routes

​

Testing

​

Related Middlewares

• helmet - Comprehensive security headers