$ show dghubble/gologin
gologin is a well-tested Go library that turns OAuth1 and OAuth2 authorization flows into chainable net/http handlers. In production it lets a web app register LoginHandler and CallbackHandler for providers (GitHub, Google, Facebook, Bitbucket, Twitter, Tumblr) and then read the authenticated user or access token from the request context in the success handler. It also provides a Twitter TokenHandler for native mobile token login. The architecture is a set of primitive handlers (state, login, callback) that communicate via context, with provider packages composing those primitives and adding a user-fetching step; session management stays orthogonal to authentication. The oauth2 subpackage implements RFC 6749 state-parameter CSRF protection with short-lived secure cookies, while the oauth1 subpackage splits request-token acquisition, auth redirect, temporary-secret persistence, and access-token callback so providers with different secret requirements reuse the same pieces. Provider packages are intentionally thin wrappers around the generic handlers and call provider APIs (go-github, go-twitter, sling, google.golang.org/api) to fetch User objects. The code is thoroughly unit-tested with httptest mocks and includes runnable examples for GitHub, Google, and Twitter. Maintenance is active and the dependency manifests are current, though a few provider endpoints lag behind platform APIs (Facebook still targets Graph API v2.9 and Twitter targets v1.1 verify_credentials), so those specific integrations may need updates. The generic OAuth1/OAuth2 machinery remains solid and portable.
The LLM identified 5 files worth highlighting for reuse:
Implements the OAuth 2 authorization-code flow as composable http.Handlers. StateHandler creates or reads a short-lived random state cookie and places the state in the request context; LoginHandler redirects to the provider AuthURL; CallbackHandler validates the returned state (RFC 6749 10.12 CSRF protection) and exchanges the code for an access token. This is a self-contained, easily portable OAuth2 login core for any Go web application.
Decomposes the OAuth1 flow into LoginHandler (obtain request token), AuthRedirectHandler (redirect to authorize URL), CookieTempHandler (persist request secret in a cookie for providers that require it), EmptyTempHandler (skip persistence for providers like Twitter), and CallbackHandler (exchange verifier for access token). This separation isolates provider-specific temporary-secret handling and is a reusable pattern for new OAuth1 integrations.
Adds EnterpriseCallbackHandler, which derives a GitHub Enterprise API base URL from the OAuth2 AuthURL (https://host/login/oauth/authorize -> https://host/api/v3/) and configures the go-github client accordingly. This lets the same login/callback chain handle both github.com and self-hosted GitHub Enterprise; the AuthURL-to-API-URL mapping is a non-obvious, reusable integration trick.
Builds http.Cookie values from a CookieConfig and converts MaxAge into an Expires field for legacy Internet Explorer compatibility. The helper is tiny, self-contained, and can be lifted into any Go HTTP library that needs consistent, secure cookie construction.
Provides test HTTP utilities: an httptest server with a custom transport that rewrites request schemes from https to http so tests can exercise TLS-scheme clients against plain HTTP test servers without certificate setup. The RewriteTransport RoundTripper pattern is generic and portable to Go HTTP client test suites.