go-middleware-skip-paths-auth-deadlock

Answer

Root cause: SessionValidator was registered globally via router.Use() with no skip paths, so /health, /metrics, and /login all sat behind the session wall. The service dead-locked: login (the only path that issues a token) itself required a token.

Fix, in three parts:

1. Add SkipPaths []string to SessionValidatorConfig and merge in mandatory defaults (health/metrics/public-auth), so an empty config can never re-deadlock the service:

type SessionValidatorConfig struct {
    SkipPaths []string            // "/*" suffix = prefix pattern; else exact match
    Validator func(r *http.Request) error
}

// Defaults are ALWAYS merged in; user entries cannot remove them.
func defaultSkipPaths() []string {
    return []string{
        "/health", "/healthz", "/metrics",   // probes & scrape
        "/login", "/register",               // public auth bootstrap
        "/oauth/authorize",                  // public OAuth dance only —
        "/oauth/callback",                   // NOT /oauth/link or /oauth/unlink
        "/oauth/token",
    }
}

func NewSessionValidator(cfg SessionValidatorConfig) *SessionValidator {
    skip := append(defaultSkipPaths(), cfg.SkipPaths...)
    return &SessionValidator{cfg: cfg, skipPaths: skip}
}

2. Check shouldSkipPath() at the top of Middleware(), before token extraction:

func (m *SessionValidator) Middleware(next http.Handler) http.Handler {
    return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
        if m.shouldSkipPath(r.URL.Path) { // ← runs first, before extractToken
            next.ServeHTTP(w, r)
            return
        }
        token, err := extractToken(r)
        if err != nil {
            http.Error(w, "missing or malformed session token", http.StatusUnauthorized)
            return
        }
        if m.cfg.Validator != nil {
            if err := m.cfg.Validator(r.WithContext(withToken(r.Context(), token))); err != nil {
                http.Error(w, "invalid or expired session", http.StatusUnauthorized)
                return
            }
        }
        next.ServeHTTP(w, r)
    })
}

3. The judge's pitfall — shouldSkipPath() must never skip authenticated OAuth paths, even under a broad /oauth/* pattern:

// These REQUIRE a session; a naive "/oauth/*" skip would expose them.
var authenticatedOAuthPaths = map[string]struct{}{
    "/oauth/link":   {},
    "/oauth/unlink": {},
}

func (m *SessionValidator) shouldSkipPath(path string) bool {
    for _, p := range m.skipPaths {
        var hit bool
        switch {
        case strings.HasSuffix(p, "/*"):            // prefix pattern:
            hit = strings.HasPrefix(path, strings.TrimSuffix(p, "*")) // "/oauth/*"→"/oauth/"
        case p == "/":
            hit = path == "/" || path == ""
        default:
            hit = path == p                          // exact match
        }
        if hit {
            if _, protected := authenticatedOAuthPaths[path]; !protected {
                return true
            }
        }
    }
    return false
}

Note the prefix semantics: strings.TrimSuffix("/oauth/*", "*") = "/oauth/", so /oauth/authorize matches but /oauth and look-alike /oauth-evil do not. Wiring stays a one-liner — no per-route annotations:

r := chi.NewRouter()
r.Use(middleware.NewSessionValidator(cfg).Middleware) // global, safe defaults