Documentation
¶
Overview ¶
Package csrf provides a double-submit-cookie CSRF middleware for VULN-008.
Flow:
- Middleware issues a signed token cookie (_csrf) on every request.
- For mutating methods (POST/PUT/PATCH/DELETE) it validates the token from the X-CSRF-Token header (HTMX) or the _csrf form field.
- TokenFromContext exposes the token to templ components via context.
Index ¶
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
func Middleware ¶
func Middleware(key []byte, secure bool, sessionToken SessionTokenGetter) func(http.Handler) http.Handler
Middleware generates or reuses a signed CSRF token, stores it in a SameSite=Strict cookie and in the request context, and validates it on mutating requests. If sessionToken is provided and returns a non-empty value, the token MAC is additionally bound to that session token.
func TokenFromContext ¶
TokenFromContext returns the CSRF token injected by Middleware. Call this from templ components to populate hidden form inputs.
Types ¶
type SessionTokenGetter ¶ added in v1.0.1
Source Files
Click to show internal directories.
Click to hide internal directories.