Core Framework

Views and Layouts

Render embedded html/template views through layouts with escaped data and explicit trusted HTML.

By Guillermo Alvarez

Embed views

The application embeds its templates:

//go:embed views public
var Files embed.FS

app.Views returns the views subtree as an fs.FS. Startup passes that filesystem to controller.NewRenderer.

The renderer requires a default layout:

layouts/app.html.tpl

Missing embedded resources fail during application initialization rather than on the first production request.

Controller view paths follow:

app/views/<controller>/<action>.html.tpl

Given:

controllers.NewBaseController(ctx, "posts")

this call:

return c.Render("index")

loads:

posts/index.html.tpl

Add values before rendering:

c.Set("title", "Posts")
c.Set("posts", c.posts.List())

Templates access them by name:

<h1>{{ .title }}</h1>

{{ range .posts }}
  <a href="/posts/{{ .Slug }}">{{ .Title }}</a>
{{ end }}

The same data map is available to the layout.

GoLazy executes the controller view first. It then passes the generated content to the selected layout as .content:

<!doctype html>
<html>
  <head>
    <title>{{ .title }}</title>
  </head>
  <body>
    <main>{{ .content }}</main>
  </body>
</html>

Use SetLayout before Render to select a layout other than app.

Go's html/template escapes ordinary data according to its HTML context. Keep user and application data as strings whenever possible.

Only convert HTML that was produced by a trusted renderer:

body, err := markdown.Convert(post.Body)
if err != nil {
    return fmt.Errorf("render post markdown: %w", err)
}

c.Set("body", template.HTML(body))

template.HTML disables escaping. Never use it merely to make untrusted input render as markup.

Render returns contextual errors for:

Return those errors from the action so controller.Handle can produce the HTTP response.