UnshareMe

Last my weekend project was to write something similar to WeHasLinks. In fact, WeHasLinks is a file sharing website, but I misread it as "We-Hash-Links" and the funny thing is that they indeed hash their links (for obvious reasons…). Anyway, WeHasLinks's links are hashed so that only the user who visited the page is allowed to them.

I liked the idea very much, and I decided to implement it in go, as an exercise! You can find the code on github. A demo is available at unshareme.lbolla.info.

The links are encrypted using AES-256 and validated using HMAC, which is the standard way to encrypt secure cookies in web apps. In fact, gorilla provides a library to do just that. The code looks pretty much like this:

var hashKey = securecookie.GenerateRandomKey(32)
var blockKey = securecookie.GenerateRandomKey(32)
var encodeName = "encodeName"
var sc = securecookie.New(hashKey, blockKey)
...

func encode(msg PersonalURL) (string, error) {
    enc, err := sc.Encode(encodeName, msg)
    ...

"Personalization" of links is done coupling each link with the remote IP visiting the page.

// Store URI and IP together
type PersonalURL struct {
    URI string
    IP string
}

When visited, the web app will decode the link, verify that the remote IP visiting it is the same as the IP who requested the links in the first place and redirect to the real url. Otherwise, a 400 will be raised.

Per se, the app is very simple but I learnt a lot about go while implementing itt: in particular, that in term of speed of development it's very close to a scripting language go's standard library is amazing and gorilla is a very nice complement for web apps.

One thing I didn't like, is how templates are handled: it's overly complicated to specify a relative path for the templates directory and templates are not compiled into the source code automatically. The easiest solution I found was to specify the path on the command line. In this case, [10][yesod has a better solution].

Full code, for reference:

package main

import (
    "encoding/base64"
    "flag"
    "fmt"
    "github.com/gorilla/securecookie"
    "github.com/gorilla/mux"
    "html/template"
    "log"
    "net/http"
    "net/url"
    "path/filepath"
    "strings"
)

// Random stuff for encoding
var hashKey = securecookie.GenerateRandomKey(32)
var blockKey = securecookie.GenerateRandomKey(32)
var encodeName = "encodeName"
var sc = securecookie.New(hashKey, blockKey)

// Router for handlers
var router = mux.NewRouter()

// Store URI and IP together
type PersonalURL struct {
    URI string
    IP string
}

// Flags
var templates_path = flag.String("t", "src/unshareme/tmpl/", "Path to the templates")
var templates = template.New("")

func encode(msg PersonalURL) (string, error) {
    enc, err := sc.Encode(encodeName, msg)
    if err != nil {
        return "", err
    }

    b64enc := base64.URLEncoding.EncodeToString([]byte(enc))

    return b64enc, nil
}

func decode(enc string) (msg PersonalURL, err error) {
    b64enc, err := base64.URLEncoding.DecodeString(enc)
    if err != nil {
        return
    }

    err = sc.Decode(encodeName, string(b64enc), &msg)
    if err != nil {
        return
    }

    return
}

// Only works for IPv4, like 127.0.0.1:12345, not IPv6 like [::1]:12345
func remoteIP(r *http.Request) string {
    // Get it from headers, as set by nginx
    ip := r.Header.Get("X-Real-IP")
    if ip == "" {
        // Strips port number
        ip = strings.Split(r.RemoteAddr, ":")[0]
    }
//         log.Print("IP:", ip)
    return ip
}

func MainHandler(w http.ResponseWriter, r *http.Request) {
    err := templates.ExecuteTemplate(w, "index.html", nil)
    if err != nil {
        http.Error(w, err.Error(), http.StatusInternalServerError)
    }
}

func EncodeHandler(w http.ResponseWriter, r *http.Request) {
    u, err := url.Parse(r.URL.Query().Get("u"))
    if err != nil {
        log.Print(err.Error())
        http.Error(w, "", http.StatusBadRequest)
        return
    }

    if u.Scheme == "" {
        http.Error(w, "Invalid scheme", http.StatusBadRequest)
        return
    }

    msg := PersonalURL{URI: u.String(), IP: remoteIP(r)}
    enc, err := encode(msg)
    if err != nil {
        log.Print(err.Error())
        http.Error(w, "", http.StatusBadRequest)
        return
    }

    link, _ := router.Get("Decode").URL("enc", enc)
    fmt.Fprint(w, link.String())
}

func DecodeHandler(w http.ResponseWriter, r *http.Request) {
    vars := mux.Vars(r)
    dec, err := decode(vars["enc"])
    if err != nil {
        log.Print(err.Error())
        http.Error(w, "", http.StatusBadRequest)
        return
    }

    if rip := remoteIP(r); dec.IP != rip {
        log.Print(dec.IP, rip)
        http.Error(w, "", http.StatusBadRequest)
        return
    }

    http.Redirect(w, r, dec.URI, http.StatusFound)
    return
}

func main() {
    flag.Parse()
    templates = template.Must(template.ParseFiles(filepath.Join(*templates_path, "index.html")))
    router.Handle("/favicon.ico", http.NotFoundHandler())
    router.HandleFunc("/", MainHandler).Methods("GET")
    router.HandleFunc("/enc", EncodeHandler).Methods("GET")
    router.HandleFunc("/dec/{enc}", DecodeHandler).Methods("GET").Name("Decode")
    http.Handle("/", router)
    log.Fatal(http.ListenAndServe(":7001", nil))
}