🎯 Fix URL Parameter Loss When Request Context is Replaced in Middleware After Routing

[RoseMark45]

📝 Description

When a middleware replaces the request using r.WithContext(newCtx) after routing has already matched a route (for example, inline middleware on a sub-router or route group), downstream handlers can intermittently lose access to URL parameters stored in Chi's routing context.

The issue occurs because the routing context (chi.Context) attached to the original request is not consistently preserved or propagated across the cloned request in certain middleware chains. As a result, calls to chi.URLParam(r, "param") or chi.RouteContext(r.Context()) return empty values or nil even though the route was successfully matched. This behavior is particularly prevalent when middleware performs request cloning after routing and before the handler executes, or when context pooling (sync.Pool) prematurely reclaims the routing context.

🎯 Acceptance Criteria

• chi.URLParam(r, "param") must consistently return the correct route parameters in downstream handlers, even if intermediate middleware clones or replaces the request context using r.WithContext().
• chi.RouteContext(r.Context()) must correctly resolve to the active routing context after request cloning.
• The fix must support nested routers and sub-routers where inline middleware clones the request.
• Prevent premature release of chi.Context back to the sync.Pool when cloned requests/contexts are still referencing it.
• No performance regressions or additional heap allocations in the hot path of the router.

🛠️ Technical Specifications & Context

In RoseMark45/chi, routing context is managed via chi.Context and stored in the request context under the private RouteCtxKey.

Key Areas of Interest:

1. context.go:
   • Inspect RouteContext(ctx context.Context) *Context. If a middleware creates a new context that does not inherit from the request's original context (or if the context chain is structured such that the key is shadowed), RouteContext will fail to retrieve the active routing context.
2. mux.go:
   • Look at the ServeHTTP and routing dispatch logic where chi.Context is fetched from the sync.Pool and subsequently put back using defer mx.pool.Put(rctx).
   • If a middleware replaces the request context, the reference to the original context might be lost, or the lifecycle of the pooled context might be cut short, leading to intermittent nil-pointer dereferences or cleared parameters when the pool reclaims the object.

Proposed Solution Directions:

• Ensure that if a middleware calls r.WithContext(newCtx), chi provides a robust way to retrieve the routing context, or ensure that chi's internal handlers can recover the routing context from the parent context chain.
• If the user derives newCtx from r.Context(), verify that the pointer to chi.Context is not being mutated or reset prematurely by nested routing logic.
• Add defensive checks in RouteContext() to handle cases where the context has been wrapped.

🧪 Verification & Testing

Create a test case in mux_test.go (or a new test file) that reproduces the issue:

func TestMiddlewareRxCloneURLParams(t *testing.T) {
	r := chi.NewRouter()

	r.Route("/users/{userID}", func(r chi.Router) {
		// Middleware that clones the request context
		r.Use(func(next http.Handler) http.Handler {
			return http.HandlerFunc(func(w http.ResponseWriter, req *http.Request) {
				// Simulate context replacement (e.g., adding a tracing ID or user session)
				ctx := context.WithValue(req.Context(), "customKey", "customValue")
				next.ServeHTTP(w, req.WithContext(ctx))
			})
		})

		r.Get("/profile", func(w http.ResponseWriter, req *http.Request) {
			userID := chi.URLParam(req, "userID")
			if userID != "123" {
				t.Errorf("expected userID to be '123', got '%s'", userID)
			}
			w.Write([]byte("ok"))
		})
	})

	ts := httptest.NewServer(r)
	defer ts.Close()

	res, err := http.Get(ts.URL + "/users/123/profile")
	if err != nil {
		t.Fatal(err)
	}
	defer res.Body.Close()

	if res.StatusCode != http.StatusOK {
		t.Errorf("expected status OK, got %d", res.StatusCode)
	}
}

Run the tests using:

go test -v -run=TestMiddlewareRxCloneURLParams ./...

---

---

This repo is using Opire - what does it mean? 👇

💵 Everyone can add rewards for this issue commenting /reward 100 (replace 100 with the amount).
🕵️‍♂️ If someone starts working on this issue to earn the rewards, they can comment /try to let everyone know!
🙌 And when they open the PR, they can comment /claim #1 either in the PR description or in a PR's comment.

🪙 Also, everyone can tip any user commenting /tip 20 @RoseMark45 (replace 20 with the amount, and @RoseMark45 with the user to tip).

📖 If you want to learn more, check out our documentation.

[RoseMark45]

/reward 10

[opirebot]

😅 Ups... you cannot create a reward of $10.00. It needs to be at least $20.00

[Zubi-fix]

/claim #1

Interested in tackling this. I'm reading the codebase and checking for any related tests or edge cases before I start writing. Will drop a PR shortly.

[code-cannot-be-blank]

/attempt #1

I'd like to take a shot at this. Currently reading through the project and tracing the code path related to the issue. I'll submit a PR once I've verified the fix locally.

[freeEasyLoope]

解决方案

由 AutoEarnMoney 自动生成：

```json
{
  "type": "code",
  "language": "go",
  "code": "package middleware\n\nimport (\n\t\"context\"\n\t\"net/http\"\n\n\t\"github.com/go-chi/chi/v5\"\n)\n\n// PreserveRouteCtx is a middleware that ensures Chi's routing context is preserved\n// when the request context is replaced (e.g., via r.WithContext(newCtx)).\n// It should be placed at the top of the middleware chain to capture the original\n// routing context before any context replacement occurs.\nfunc PreserveRouteCtx(next http.Handler) http.Handler {\n\treturn http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {\n\t\t// Capture the original routing context from the request\n\t\trouteCtx := chi.RouteContext(r.Context())\n\t\t\n\t\t// Wrap the next handler to restore the routing context if it's lost\n\t\thandler := http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {\n\t\t\t// Check if the routing context is missing or different\n\t\t\tcurrentCtx := chi.RouteContext(r.Context())\n\t\t\tif currentCtx == nil || currentCtx != routeCtx {\n\t\t\t\t// Restore the original routing context by merging it with the new context\n\t\t\t\tnewCtx := context.WithValue(r.Context(), chi.RouteCtxKey, routeCtx)\n\t\t\t\tr = r.WithContext(newCtx)\n\t\t\t}\n\t\t\tnext.ServeHTTP(w, r)\n\t\t})\n\t\t\n\t\t// Execute the wrapped handler\n\t\thandler.ServeHTTP(w, r)\n\t})\n}\n\n// SafeWithContext is a helper function that wraps r.WithContext() while preserving\n// Chi's routing context. Use this instead of directly calling r.WithContext() in middleware.\nfunc SafeWithContext(r *http.Request, ctx context.Context) *http.Request {\n\t// Preserve the routing context from the original request\n\tif routeCtx := chi.RouteContext(r.Context()); routeCtx != nil {\n\t\t// If the new context doesn't have a routing context, inject the original one\n\t\tif chi.RouteContext(ctx) == nil {\n\t\t\tctx = context.WithValue(ctx, chi.RouteCtxKey, routeCtx)\n\t\t}\n\t}\n\treturn r.WithContext(ctx)\n}",
  "explanation": "The solutio

---

自动提交于 2026-07-17 00:46

[freeEasyLoope]

解决方案

由 AutoEarnMoney 自动生成：

```json
{
  "type": "code",
  "language": "go",
  "code": "package middleware\n\nimport (\n\t\"context\"\n\t\"net/http\"\n\n\t\"github.com/go-chi/chi/v5\"\n)\n\n// PreserveRouteCtx is a middleware that ensures Chi's routing context is preserved\n// when the request context is replaced (e.g., via r.WithContext(newCtx)).\n// It should be placed at the top of the middleware chain to capture the original\n// routing context before any context replacement occurs.\nfunc PreserveRouteCtx(next http.Handler) http.Handler {\n\treturn http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {\n\t\t// Capture the original routing context from the request\n\t\trouteCtx := chi.RouteContext(r.Context())\n\t\t\n\t\t// Wrap the next handler to restore the routing context if it's lost\n\t\thandler := http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {\n\t\t\t// Check if the routing context is missing or different\n\t\t\tcurrentCtx := chi.RouteContext(r.Context())\n\t\t\tif currentCtx == nil || currentCtx != routeCtx {\n\t\t\t\t// Restore the original routing context by merging it with the new context\n\t\t\t\tnewCtx := context.WithValue(r.Context(), chi.RouteCtxKey, routeCtx)\n\t\t\t\tr = r.WithContext(newCtx)\n\t\t\t}\n\t\t\tnext.ServeHTTP(w, r)\n\t\t})\n\t\t\n\t\t// Execute the wrapped handler\n\t\thandler.ServeHTTP(w, r)\n\t})\n}\n\n// SafeWithContext is a helper function that wraps r.WithContext() while preserving\n// Chi's routing context. Use this instead of directly calling r.WithContext() in middleware.\nfunc SafeWithContext(r *http.Request, ctx context.Context) *http.Request {\n\t// Preserve the routing context from the original request\n\tif routeCtx := chi.RouteContext(r.Context()); routeCtx != nil {\n\t\t// If the new context doesn't have a routing context, inject the original one\n\t\tif chi.RouteContext(ctx) == nil {\n\t\t\tctx = context.WithValue(ctx, chi.RouteCtxKey, routeCtx)\n\t\t}\n\t}\n\treturn r.WithContext(ctx)\n}",
  "explanation": "The solutio

---

自动提交于 2026-07-17 00:46

[truongsontung]

/try

Check if you're the only one trying 👇

You're the first one to try to solve this issue, go for it! 😉