[Proposal]: Replace gorilla/mux with net/http's mux

[jvoisin]

Proposal Summary

Replace gorilla/mux with net/http's mux

Motivation and Context

gorilla/mux was unmaintained for some time around 2023, and while some new maintainers stepped up, the current status is unclear.

Moreover, it's based on regexes instead of maps, which is suboptimal but was the right choice before Go added a proper muxer in its stdlib.

Getting rid of gorilla/mux would bring the following benefits:

• removing a third-party dependency, thus increasing the security of the project against supply-chain issues
• simply the source code
• ensure that should gorilla/mux stop being maintained (which seems to be the case), miniflux wouldn't need to move in a hurry
• speed up page rendering, as currently numerous calls to internal/http/route/route.go:Path are done every time a page is rendered, around 250 times on my /unread page.

Proposed Solution

There was already a tentative in #2863, but I wasn't familiar enough with the codebase to properly move it forward.

Miniflux is currently using the following mux features:

• subrouters: to attach routers on other routers, like for example attaching the API router to the /v1 one, allowing every router from the API to live under the /v1/ router.
• reverse urls: to obtain the URL corresponding to provided arguments, like route.Path(f.router, "appIcon", "filename", "sprite.svg") → /icon/sprite.svg

Those could be removed/replaced if miniflux switches to fixed paths, like "the path to sprite.svg is always /icon/sprite.svg." This would remove the possibility of hosting miniflux under a prefixed path, like mydomain.com/miniflux/<miniflux_lives_here>, but I don't think this was ever supported. How do you feel about this @fguillot ?

Every other feature used by miniflux can easily be ported to Go's stdlib http/mux.

Alternatives Considered

Maintain gorilla/mux ourselves :D

Impact and Risks

None.

Additional Context or References

No response

Checklist

• I have reviewed existing proposals to ensure this change hasn't been proposed before.
• I agree to provide follow-up updates and maintain discussion on this proposal.
• I agree to follow the project's contribution guidelines.

[fguillot]

I'm 100% okay with getting rid of gorilla/mux.

Running Miniflux in a subfolder is a supported use-case and it's documented here. The base path is determined when parsing the BASE_URL.

I haven't tried yet, but something like this might work: http.HandleFunc("GET "+basePath+"unread/entry/{entryID}", showUnreadEntryPage) and basePath could be / as default.

The routes are also named, and these names are used in various middlewares.

I don't know how you are planning to implement this, but having a thin abstraction above net/http might be possible. For example:

basePath := "/miniflux"
router := route.NewCustomRouter(basePath)

// Calls ServeMux.HandleFunc(`GET /feeds/{feedID}/entries`, handleFeedEntries) behind the scene
router.HandleFunc(http.MethodGet, "/feeds/{feedID}/entries", "feedEntries", handleFeedEntries)

// Generates /miniflux/feeds/1234/entries
router.URLPath("feedEntries", 1234)

That's just an idea; I need to think more about it.

[jvoisin]

The routes are also named, and these names are used in various middlewares.

We can simply replace the names with the routes themselves.

[fguillot]

The routes are also named, and these names are used in various middlewares.

We can simply replace the names with the routes themselves.

Some of these routes have parameters. For example, the feedIcon route is /feed/icon/{externalIconID} and sharedEntry is /share/{shareCode}. What do you do in this case? Check the prefix?

Changing the share URL will break existing links, and changing the public feed icon url could break some clients (can't tell if they are storing a local copy during sync).

v2/internal/ui/middleware.go

Lines 153 to 177 in 2c4f4e2

	func (m *middleware) isPublicRoute(r *http.Request) bool {
	route := mux.CurrentRoute(r)
	switch route.GetName() {
	case "login",
	"checkLogin",
	"stylesheet",
	"javascript",
	"oauth2Redirect",
	"oauth2Callback",
	"appIcon",
	"feedIcon",
	"favicon",
	"webManifest",
	"robots",
	"sharedEntry",
	"healthcheck",
	"offline",
	"proxy",
	"webauthnLoginBegin",
	"webauthnLoginFinish":
	return true
	default:
	return false
	}
	}

[jvoisin]

We can use a format string I think.