Golang : Gorilla web tool kit secure cookie example

Sometimes we need to track user payment status and store the items to be purchased in the browser's cookies cache/jar. It will be wise to encrypt the cookie so that it cannot be manipulated or forged. For example, a malicious buyer will add 3 more items into the cart but only pay for 1 item during check out.

The code below is an example on how to use the Gorilla web tool kit secure cookie package. The cookie is encrypted in the SetCookieHandler() and the decrypted in the ReadCookieHandler().

 package main

 import (
 "fmt"
 "github.com/gorilla/mux"
 "github.com/gorilla/securecookie"
 "net/http"
 )

 //var hashKey = []byte("very-secret")

 //var blockKey = []byte("a-lot-secret")

 //var sc = securecookie.New(hashKey, blockKey)

 var sc = securecookie.New(securecookie.GenerateRandomKey(64), securecookie.GenerateRandomKey(32))



 func SetCookieHandler(w http.ResponseWriter, r *http.Request) {

 value := map[string]string{
 "name": "username",
 }

 if encoded, err := sc.Encode("cookie-name", value); err == nil {
 cookie := &http.Cookie{
 Name:  "cookie-name",
 Value: encoded,
 Path:  "/",
 }

 http.SetCookie(w, cookie)
 }

 // inspect your cookie cache within your browser...
 w.Write([]byte(fmt.Sprintf("Cookie encoded. Inspect your browser's cookies cache")))
 }

 func ReadCookieHandler(w http.ResponseWriter, r *http.Request) {

 w.Write([]byte(fmt.Sprintf("Decoding cookie ")))
 // retrieve cookie from request

 if cookie, err := r.Cookie("cookie-name"); err == nil {
 value := make(map[string]string)

 if err = sc.Decode("cookie-name", cookie.Value, &value); err == nil {
 w.Write([]byte(fmt.Sprintf("The value of name is %v \n", value["name"])))
 }
 }

 }

 func main() {
 mx := mux.NewRouter()

 mx.HandleFunc("/", SetCookieHandler)
 mx.HandleFunc("/get", ReadCookieHandler)

 http.ListenAndServe(":8080", mx)
 }

Visit the localhost:8080 and you should see this message :

Cookie encoded. Inspect your browser's cookies cache

Under Chrome, the steps are right-click on the page, Inspect Element and click on the Resources tab. You should be able to see a cookie with the name "cookie-name" and some unreadable value.

and visit localhost:8080/get to decrypt the encrypted cookie value.

Hope this helps!

References :

http://www.gorillatoolkit.org/pkg/securecookie

http://golang.org/pkg/net/http/#SetCookie