Be wary of http/client.go
Recently, I found out an interesting problem in Go. The problem can be reduced to a simple client request to a HTTP server.
Suppose we have a HTTP server, which serves only one rooted path /foo/.
package main
import (
"io"
"log"
"net/http"
"net/http/httputil"
)
func handleFoo(w http.ResponseWriter, req *http.Request) {
// request details
dump, _ := httputil.DumpRequest(req, true)
log.Println(string(dump))
if auth := req.Header.Get("Authorization"); auth != "Bearer GoodToken" {
http.Error(w, "401 Unauthorized", http.StatusUnauthorized)
return
}
io.WriteString(w, "Hello World!")
}
func main() {
http.HandleFunc("/foo/", handleFoo)
log.Fatal(http.ListenAndServe(":12345", nil))
}
handleFoo simplily verifies that correct token is sent in the Authorization header. Otherwise, it returns 401 Unauthorized.