Middleware for Authentication

[alfnsnff]

I wanna ask about the middleware

What if there is middleware for auth?

Is it also put under the middleware folder, inside e.g controller/http same like logger and recovery with plain function (no constructor like "NewAuthMiddleware"?

Or should it have another folder?

[soltanoff]

Hi!

It depends on the logic of your application. If you want the middleware only for HTTP, you can put all the code directly in internal/controller/http/middleware, for example.

But in my opinion it would be nice if the authorization logic should be shared between different types of controllers (for example, HTTP, gRPC, AMQP), then it’s better to place the main authorization logic in a separate package, such as pkg/auth. After that, you can reuse this common logic in different middleware — in internal/controller/http/middleware, internal/controller/grpc/middleware, internal/controller/amqp_rpc/middleware, etc.

This way, the specific middleware will act as a "wrapper" that uses the shared authorization logic from pkg/auth, but adapts it for the required protocol and framework.