CodeVetter · Repo Unpack · Feature catalog

labstack/echo

Scanned commit 99c395d846 dated 2026-10-01 — last upstream commit. Generated by codevetter codevetter 1.15.0 on 2026-10-02. Deep analysis by cli:codex via the codex CLI on 2026-10-02 (480s). Source inspection; upstream code and tests were not executed.

Echo exposes developer-facing APIs rather than a fixed collection of application screens or business routes. Its features cover routing, input conversion, output formats, static content, security policies, traffic management, and observability. Middleware is explicitly installed by consuming applications, and configuration factories allow customization. The catalog below groups the inspected capabilities; the investigation is bounded rather than exhaustive.

Routing supports HTTP method helpers including QUERY, custom method registration, Any/Match, fallback routes, nested groups, and named route reversal. NewVirtualHostHandler dispatches exact request Host matches to separate Echo instances, falling back to its own routes.
echo.go#L534-L626 group.go#L137-L143 route.go#L82-L136 vhost.go#L8-L19
Input APIs bind path, query, header, JSON, XML, URL-encoded form, and multipart data. ValueBinder provides fluent source-specific conversion with fail-fast or accumulated errors, while generic PathParam/QueryParam helpers distinguish missing values from empty values.
bind.go#L43-L140 binder.go#L112-L223 binder_generic.go#L48-L122
Context supports HTML, text, JSON, validated JSONP, XML, blobs, streaming, attachments, inline files, redirects, and empty responses; Render delegates to a configured template renderer. Error output can use the default JSON handler or RFC 9457 Problem Details.
context.go#L474-L506 context.go#L509-L610 context.go#L637-L768 rfc9457.go#L49-L64 echo.go#L458-L517
Static and StaticFS register filesystem-backed GET routes; File/FileFS expose individual files. Static middleware additionally offers configurable index files, directory browsing, group-base handling, and HTML5 index fallback restricted to router-level 404 errors.
echo.go#L629-L652 echo.go#L705-L731 middleware/static.go#L24-L84 middleware/static.go#L278-L335
Security middleware includes callback-driven BasicAuth and KeyAuth, CSRF protection using fetch metadata or cookie/token comparison, configured CORS origins, and Secure headers such as CSP and HSTS. CORS rejects wildcard origins with credentials unless custom origin logic is supplied.
middleware/basic_auth.go#L97-L155 middleware/key_auth.go#L138-L204 middleware/csrf.go#L168-L259 middleware/csrf.go#L264-L310 middleware/cors.go#L171-L189 middleware/secure.go#L127-L151
Traffic APIs provide token-bucket rate limiting with custom stores and response headers, reverse proxying with random or round-robin balancing, retries, rewrites, custom transports, response modification, and WebSocket forwarding. StartConfig supplies HTTP/TLS listener and shutdown controls.
middleware/rate_limiter.go#L124-L165 middleware/rate_limiter.go#L263-L300 middleware/proxy.go#L29-L104 middleware/proxy.go#L370-L411 server.go#L25-L60
Request transformation middleware includes method override, wildcard/regex rewrites, trailing-slash normalization, and HTTPS/www redirects. Payload middleware supplies configurable gzip responses, gzip request decompression with a default 100 MiB expansion limit, BodyLimit, and cooperative ContextTimeout handling.
middleware/method_override.go#L35-L78 middleware/rewrite.go#L14-L34 middleware/slash.go#L25-L76 middleware/slash.go#L102-L141 middleware/redirect.go#L33-L80 middleware/redirect.go#L104-L145 middleware/compress.go#L24-L65 middleware/decompress.go#L24-L62 middleware/body_limit.go#L49-L76 middleware/context_timeout.go#L38-L70
RequestLogger offers selectable request/response fields and a default slog callback; RequestID propagates or generates an ID in response headers. BodyDump calls an application callback with payloads and handler errors, while Recover converts ordinary panics into returned errors and rethrows http.ErrAbortHandler.
middleware/request_logger.go#L128-L177 middleware/request_logger.go#L394-L425 middleware/request_id.go#L53-L71 middleware/body_dump.go#L111-L141 middleware/recover.go#L68-L85