From 44a34fcba7bf9e17921b0ffbebe006d86aed37d8 Mon Sep 17 00:00:00 2001 From: Branden J Brown Date: Sun, 21 Jan 2024 20:27:48 -0600 Subject: [PATCH] implement consent cookie thing Fixes #3. --- serve/consent.go | 42 ++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 42 insertions(+) create mode 100644 serve/consent.go diff --git a/serve/consent.go b/serve/consent.go new file mode 100644 index 0000000..8d15f65 --- /dev/null +++ b/serve/consent.go @@ -0,0 +1,42 @@ +package serve + +import ( + "net/http" + "time" +) + +const cookieName = "__Host-consent-v1" + +// SetConsent registers a consent cookie on the response. +func SetConsent(w http.ResponseWriter) { + http.SetCookie(w, &http.Cookie{ + Name: cookieName, + Value: "given", + Expires: time.Now().Add(20 * 365 * 24 * time.Hour), + Path: "/", + Secure: true, + HttpOnly: true, + SameSite: http.SameSiteLaxMode, + }) +} + +// NeedsConsent is a middleware that immediately responds with a 403 if the +// request does not bear a consent cookie. +func NeedsConsent(next http.Handler) http.Handler { + return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) { + if _, err := r.Cookie(cookieName); err != nil { + http.Error(w, cookieFailed, http.StatusForbidden) + return + } + next.ServeHTTP(w, r) + }) +} + +const cookieFailed = ` + + +

Consent required

+

The requested resource requires consent to processing identifying information and storying necessary cookies.

+

I'm just a lil guy. The information is used solely for providing the service's functionality.

+ +`