Documentation
¶
Index ¶
Constants ¶
This section is empty.
Variables ¶
Functions ¶
func GenerateToken ¶
GenerateToken creates a cryptographically secure random token
func ValidateToken ¶
ValidateToken compares tokens using constant-time comparison to prevent timing attacks
Types ¶
type CSRF ¶
type CSRF struct {
// contains filtered or unexported fields
}
CSRF provides CSRF protection functionality
func FromContext ¶ added in v0.9.13
FromContext extracts the *CSRF from a router.Context. Returns nil if CSRF is not configured.
func (*CSRF) Middleware ¶
Middleware returns HTTP middleware that validates CSRF tokens
func (*CSRF) RefreshHandler ¶
func (c *CSRF) RefreshHandler() http.HandlerFunc
RefreshHandler returns a handler that generates and returns a new CSRF token
func (*CSRF) RouterMiddleware ¶ added in v0.9.5
func (c *CSRF) RouterMiddleware() router.MiddlewareFunc
RouterMiddleware returns a router.MiddlewareFunc that validates CSRF tokens. This is the instance-based alternative to the global Middleware() function.
type Config ¶
type Config struct {
// Token settings
TokenLifetime time.Duration
HeaderName string
FormField string
CookieName string
SessionCookieName string // Name of the session cookie to read session ID from
// Security settings
SameSite http.SameSite
Secure bool
HTTPOnly bool
SingleUse bool
// Storage strategy
Store Store
// Exception handling
ExcludePaths []string
ExcludeFunc func(*http.Request) bool
// Error handling
ErrorTemplate string
ErrorMessage string
ErrorHandler func(http.ResponseWriter, *http.Request, error)
}
Config holds CSRF protection configuration
func DefaultConfig ¶
func DefaultConfig() *Config
DefaultConfig returns the default CSRF configuration
type Store ¶
type Store interface {
// Get retrieves a token for the given session/identifier
Get(id string) (string, error)
// Set stores a token for the given session/identifier
Set(id string, token string) error
// Delete removes a token
Delete(id string) error
// Exists checks if a token exists
Exists(id string) bool
}
Store defines the interface for CSRF token storage
Source Files
Directories
Click to show internal directories.
Click to hide internal directories.