kodev-org
/
vikunja
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

fix(routes): generate request IDs at the start of the middleware chain 

Echo's RequestID middleware reuses the X-Request-Id header from a proxy
or generates one, so logging and audit all see the same ID. RequestMeta
previously read the request header before any later middleware could
have set one, leaving the audit request_id mostly empty.
This commit is contained in:
kolaente 2026-06-11 21:32:25 +02:00
parent 9a50cd0ceb
commit 8b09e67da0
2 changed files with 10 additions and 8 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

13
pkg/routes/middleware/request_meta.go
View File

@ -22,21 +22,18 @@ import (
"github.com/labstack/echo/v5"
)
// RequestMeta stashes IP, User-Agent and X-Request-ID on the request context
// so events dispatched while handling the request carry them as message
// metadata (consumed by the audit listeners).
// RequestMeta stashes IP, User-Agent and the request ID on the request
// context so events dispatched while handling the request carry them as
// message metadata (consumed by the audit listeners). Must run after the
// RequestID middleware, which guarantees the response header is populated.
func RequestMeta() echo.MiddlewareFunc {
return func(next echo.HandlerFunc) echo.HandlerFunc {
return func(c *echo.Context) error {
req := c.Request()
requestID := req.Header.Get(echo.HeaderXRequestID)
if requestID == "" {
requestID = c.Response().Header().Get(echo.HeaderXRequestID)
}
ctx := events.WithRequestMeta(req.Context(), &events.RequestMeta{
IP: c.RealIP(),
UserAgent: req.UserAgent(),
RequestID: requestID,
RequestID: c.Response().Header().Get(echo.HeaderXRequestID),
})
c.SetRequest(req.WithContext(ctx))
return next(c)

5
pkg/routes/routes.go
View File

@ -155,6 +155,11 @@ func NewEcho() *echo.Echo {
e.Logger = log.NewEchoLogger(config.LogEnabled.GetBool(), config.LogHTTP.GetString(), config.LogFormat.GetString())
// First middleware in the chain so every request has an ID — reuses the
// X-Request-Id header from a proxy or generates one — and everything
// downstream (logging, audit) sees the same value.
e.Use(middleware.RequestID())
// Logger
if config.LogEnabled.GetBool() && config.LogHTTP.GetString() != "off" {
httpLogger := log.NewHTTPLogger(config.LogEnabled.GetBool(), config.LogHTTP.GetString(), config.LogFormat.GetString())