CIDR allowlist middleware using netip (trust boundary explicit)

                  package middleware

import (
  "net"
  "net/http"
  "net/netip"
)

func AllowCIDRs(prefixes []netip.Prefix) func(http.Handler) http.Handler {
  return func(next http.Handler) http.Handler {
    return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
      host, _, err := net.SplitHostPort(r.RemoteAddr)
      if err != nil {
        http.Error(w, "forbidden", http.StatusForbidden)
        return
      }
      addr, err := netip.ParseAddr(host)
      if err != nil {
        http.Error(w, "forbidden", http.StatusForbidden)
        return
      }
      ok := false
      for _, p := range prefixes {
        if p.Contains(addr) {
          ok = true
          break
        }
      }
      if !ok {
        http.Error(w, "forbidden", http.StatusForbidden)
        return
      }
      next.ServeHTTP(w, r)
    })
  }
}