Headers get overwritten if using multiple custom middlewares

[david-alza]

If you use multiple custom middlewares then the timeout middleware will overwrite previous status codes.

package main

import (
    "log"
    "net/http"
    "time"

    "github.com/gin-contrib/timeout"
    "github.com/gin-gonic/gin"
)

func testResponse(c *gin.Context) {
    c.String(http.StatusRequestTimeout, "timeout")
}

// custom middleware straight from example
func timeoutMiddleware() gin.HandlerFunc {
    return timeout.New(
        timeout.WithTimeout(500*time.Millisecond),
        timeout.WithHandler(func(c *gin.Context) {
            c.Next()
        }),
        timeout.WithResponse(testResponse),
    )
}

// simple middleware to always throw a 401
func authMiddleware() gin.HandlerFunc {
    return func(c *gin.Context) {
        c.AbortWithStatus(401)
        return
    }
}

func main() {
    r := gin.New()

    // middleware
    r.Use(gin.Logger())
    r.Use(timeoutMiddleware()) // 1. timeout middleware
    r.Use(authMiddleware())    // 2. auth middleware
    r.Use(gin.Recovery())      // recommend to use this middleware to recover from any panics in the handlers.

    r.GET("/", func(c *gin.Context) {
        time.Sleep(1000 * time.Millisecond)
        c.String(http.StatusOK, "Hello world!")
    })
    if err := r.Run(":8080"); err != nil {
        log.Fatal(err)
    }
}

result:

HTTP/1.1 200 OK

gin logs:

[GIN-debug] [WARNING] Headers were already written. Wanted to override status code 200 with 401
[GIN] 2022/08/25 - 16:58:19 | 401 |      25.583µs |       127.0.0.1 | GET      "/"

If you change the order of the middlewares then the timeout never applies correctly.

We swapped to https://github.com/vearne/gin-timeout and the issue doesn't occur there.