Middleware

Zinc ships 29 middleware in one package, github.com/0mjs/zinc/middleware. Each is an ordinary func(*zinc.Context) error, so you can attach it to the whole app, a group, or a single route. Standard net/http middleware works too, through app.UseHTTP.

A good default stack

Most JSON APIs start here. Order matters: each entry wraps everything after it.

app.Use(
  middleware.RequestID(),     // 1. tag the request first, so everything can log the ID
  middleware.RequestLogger(), // 2. log every request, including failures below
  middleware.Recover(),       // 3. turn panics into 500s that the logger records
  middleware.Secure(),        // 4. browser security headers
)

Add CORS when browsers on other origins call the API, Context Timeout to bound slow requests, and an auth middleware on the groups that need it.

Start with the request path

These are the pieces most services add first.

Request IDGenerate or propagate an X-Request-ID value.

Request LoggerRecord status, latency, route, headers, and returned errors.

RecoverReturn panics through Zinc's normal error path.

Secure HeadersSet practical browser security response headers.

CORSControl browser origins and preflight requests.

Body LimitReject request bodies above a configured size.

Context TimeoutAttach a deadline to the remaining handler chain.

Rate LimiterApply token-bucket limits by app, IP, or custom key.

Identity and access

Basic AuthProtect a small internal or administrative surface.

Key AuthRead opaque API keys from headers, queries, or cookies.

JWTValidate bearer tokens and expose typed claims.

SessionStore small signed session values in cookies.

CSRFProtect cookie-authenticated browser requests.

Casbin AuthDelegate authorization to a Casbin-compatible enforcer.

Header GuardsRequire content types or match custom request headers.

Delivery and observability

GzipCompress responses when the client accepts gzip.

DecompressDecode gzip request bodies before handlers read them.

StaticServe static files from middleware.

ProxyReverse proxy requests with net/http/httputil.

PrometheusExpose request counters and duration metrics.

OpenTelemetryTrace Zinc requests with standard OTel tooling.

JaegerPropagate Uber-Trace-Id and observe spans.

pprofMount standard-library profiling routes.

Body DumpCapture request and response bodies for deliberate debugging.

Request shaping

RewriteChange a request path before route dispatch.

RedirectRedirect exact and wildcard paths.

Method OverrideTunnel PUT, PATCH, or DELETE through POST.

Trailing SlashAdd, remove, or redirect slash variants.

UtilityThrottle, heartbeat, no-cache, conditional, real-IP, and header helpers.

Put middleware where it belongs

Use app middleware for every request:

app.Use(middleware.RequestID(), middleware.RequestLogger())

Use group middleware for a route family:

api := app.Group("/api")
api.Use(middleware.JWT(keyFunc))

Use route middleware for one endpoint:

app.Post("/exports", middleware.RateLimiter(), startExport)

Read Groups and Middleware for execution order and c.Next(), or Errors for returned middleware errors.