csrf

func AllowConfiguredCORSOrigins ¶ added in v2.54.0

func AllowConfiguredCORSOrigins(cfgProvider config.ConfigProvider) func(echo.Context) (bool, error)

AllowConfiguredCORSOrigins builds the AllowSecFetchSiteFunc for echo's CSRF middleware. Echo only calls it for state-changing requests whose Sec-Fetch-Site is "same-site" or "cross-site"; safe methods, "same-origin", "none" and requests without the header are resolved before this is reached.

Echo's default is to reject every cross-site request outright, before any token is looked at. That would break deployments serving the UI from a separate origin listed in cors.allowOrigins, so those requests fall through to X-CSRF-Token validation instead, which is how they were handled before echo v4.15.0.

Returning (false, nil) means "not pre-approved, validate the token" rather than "allow": the token check still gates the request.

func EnsureTokenCookie ¶ added in v2.54.0

func EnsureTokenCookie(cookieSecure bool) echo.MiddlewareFunc

EnsureTokenCookie issues the _csrf cookie that the UI reads and sends back as the X-CSRF-Token header.

Echo's CSRF middleware stopped issuing it to browsers in v4.15.0: when a request carries a Sec-Fetch-Site header the middleware short-circuits before reaching its cookie-setting code, so only clients that omit the header (curl, other servers) ever receive one. Browsers always send it, which leaves the UI with no token — and every state-changing request rejected as soon as Sec-Fetch-Site is "same-site", which is the case whenever the UI and the API are served on different ports.

This runs ahead of the CSRF middleware and mints the token itself when the request carries none, attaching it to the request as well as the response so that the CSRF middleware validates against the same value the browser was handed.

func MiddlewareConfig ¶ added in v2.54.0

func MiddlewareConfig(cfgProvider config.ConfigProvider, cookieSecure bool) middleware.CSRFConfig

MiddlewareConfig returns the configuration for echo's CSRF middleware.

It is paired with EnsureTokenCookie, which mints the cookie this configuration validates against; the two share the cookie attributes below and must be installed together, EnsureTokenCookie first.

func SkipOnAuthorizationHeader ¶

func SkipOnAuthorizationHeader(c echo.Context) bool