csrf

package
v0.23.1 Latest Latest
Warning

This package is not in the latest version of its module.

 Go to latest Published: Oct 21, 2026 License: MIT Imports: 7 Imported by: 0

Documentation

Overview

Package csrf provides session-bound synchronizer tokens.

The package deliberately does not inspect HTTP requests. Applications choose where a submitted token comes from and pass it to Validate explicitly.

Index

Constants

This section is empty.

Variables

View Source 
var (
	// ErrInvalidToken indicates that a submitted token is absent, malformed, or
	// does not belong to the current session.
	ErrInvalidToken = errors.New("csrf: invalid token")
	// ErrSessionRequired indicates programmer error: CSRF tokens must be bound
	// to an initialized session.
	ErrSessionRequired = errors.New("csrf: session is required")
)

Functions

func Ensure 

func Ensure(current *session.Session) (string, error)

Ensure returns the current session's token, creating one when absent. The caller must save the session before writing the response when a token is created.

func Rotate 

func Rotate(current *session.Session) (string, error)

Rotate replaces the current session's token with a cryptographically random token. Rotate after authentication state changes or suspected disclosure. The caller must save the session before writing the response.

func Validate 

func Validate(current *session.Session, submitted string) error

Validate verifies that submitted is a well-formed token belonging to the current session. Token bytes are compared in constant time. The returned errors never contain either the submitted or stored token.

Types

This section is empty.

Source Files

View all Source files

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL
go.dev uses cookies from Google to deliver and enhance the quality of its services and to analyze traffic. Learn more.