Echo custom authentication middleware not short circuting route.

[geekbozu]

I wrote a custom middle ware to handle authentication and other things the way we want it to work on our application.
A shortened example that is known to exhibit the same issue I'm having is below.

func SessionAuth() echo.MiddlewareFunc {
	return func(next echo.HandlerFunc) echo.HandlerFunc {
		return func(c echo.Context) error {
			if err := next(c); err != nil {
				c.Error(err)
			}

			sess, _ := session.Get("session", c)
			if sess.IsNew == true {
				return echo.ErrUnauthorized
			}

			if sess.Values["authenticated"].(bool) == true {
				return next(c)
			}
			return echo.ErrUnauthorized

		}
	}
}

I am registering this middleware with

e.Use(mymiddleware.SessionAuth())

I would expect this to return echo.ErrUnauthorized back to the requesting client. However it still returns the target endpoints data.
Using the debugger I am also seeing that it seems like My handler is being called before this middleware is even being executed...which kinda defeats the purpose of auth to a degree as well?
I am confused as to why this is happening.... Not sure if this is a bug or just user error so I figured i would ask here isntead of in the Issues section for now.
Thanks

[geekbozu]

Well I'll answer my own question...
This was copied out of the middle ware example on the docs page. The comments/code looks like its just an error handler for something but its actually processing the middleware chain and looking for an error before processing the code below it.
This makes sense for the statistics logger example given.
However its really bad for boiler plate middleware code....oh well I hope someone on the google fu finds this and can learn from my mistake

			if err := next(c); err != nil {
				c.Error(err)
			}

[jdelamar]

I just did learn from your mistakes! Thanks!

[aldas]

If you find doing yourself using c.Error(err) you are probably doing something wrong. There are very few cases where it is valid solution to problems.

There is doc comment about Error behavior:

echo/context.go

Lines 174 to 179 in 447c92d

	// Error invokes the registered global HTTP error handler. Generally used by middleware.
	// A side-effect of calling global error handler is that now Response has been committed (sent to the client) and
	// middlewares up in chain can not change Response status code or Response body anymore.
	//
	// Avoid using this method in handlers as no middleware will be able to effectively handle errors after that.
	Error(err error)

[geekbozu]

Glad this turned out to be helpful!
@aldas
Good info!
The point of concern here is that the middleware cookbook
The example code uses the above pattern, which is not very clear.
Nor is its use well elaborated on in something that I would consider a good copy paste launch point.