Documentation
¶
Overview ¶
Package csrf provides a double-submit-cookie CSRF middleware for VULN-008.
Flow:
- Middleware issues a signed token cookie (_csrf) on every request.
- For mutating methods (POST/PUT/PATCH/DELETE) it validates the token from the X-CSRF-Token header (HTMX) or the _csrf form field.
- TokenFromContext exposes the token to templ components via context.
Index ¶
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
func Middleware ¶
Middleware generates or reuses a signed CSRF token per session, stores it in a SameSite=Strict cookie and in the request context, and validates it on mutating requests. Pass secure=true in production so the cookie is HTTPS-only.
func TokenFromContext ¶
TokenFromContext returns the CSRF token injected by Middleware. Call this from templ components to populate hidden form inputs.
Types ¶
This section is empty.
Source Files
Click to show internal directories.
Click to hide internal directories.