Code reviewMediumcr-g042

Subject Auth bypassLevel Mid–Senior~25 minCommon in Security interviewsIndustries Software development

Question

Review this Go middleware that authenticates internal service-to-service calls with a shared API key.

What a strong answer looks like

Separate real bugs from style. Rank issues by severity, point at the root cause rather than the symptom, and suggest a concrete fix — specific and kind.

Learn the concepts

Talk through your review

Code to reviewgo

1func requireAPIKey(next http.Handler) http.Handler {2    return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {3        provided := r.Header.Get("X-Api-Key")4        if provided == os.Getenv("INTERNAL_API_KEY") {5            next.ServeHTTP(w, r)6            return7        }8        http.Error(w, "forbidden", http.StatusForbidden)9    })10}

Run or narrate your approach, then ask the coach.