Documentation
¶
Overview ¶
Package csrf protects state-changing requests from cross-site request forgery using Go's http.CrossOriginProtection (Fetch Metadata and Origin checks, no tokens needed in modern browsers), with an optional session-token fallback for clients that send neither header.
Index ¶
Constants ¶
View Source
const FieldName = "_token"
FieldName is the form field carrying the fallback token.
View Source
const HeaderName = "X-CSRF-Token"
HeaderName is the request header carrying the fallback token.
Variables ¶
This section is empty.
Functions ¶
func Middleware ¶
Middleware returns CSRF middleware for the router stack (after session middleware when TokenFallback is enabled). Rejections answer 403 through the error handler and log a "csrf.rejected" security event (A01/A08).
Types ¶
type Config ¶
type Config struct {
// TrustedOrigins are other origins allowed to send unsafe requests,
// e.g. "https://admin.example.com".
TrustedOrigins []string
// BypassPatterns are ServeMux patterns exempt from checks (webhooks).
// Bypasses are explicit and logged at boot by the caller.
BypassPatterns []string
// TokenFallback requires a session token on unsafe requests that carry
// neither Sec-Fetch-Site nor Origin but do carry a session (old
// browsers). API clients without sessions are unaffected.
TokenFallback bool
}
Config configures Middleware.
Source Files
Click to show internal directories.
Click to hide internal directories.