A web blog and personal homepage engine written in Go.
You can not select more than 25 topics Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
 
 

55 lines
1.5 KiB

package middleware
import (
"context"
"net/http"
"time"
"git.kirsle.net/apps/gophertype/pkg/constants"
"git.kirsle.net/apps/gophertype/pkg/responses"
"git.kirsle.net/apps/gophertype/pkg/session"
uuid "github.com/satori/go.uuid"
)
// CSRF prevents Cross-Site Request Forgery.
// All "POST" requests are required to have an "_csrf" variable passed in which
// matches the "csrf_token" HTTP cookie with their request.
func CSRF(next http.Handler) http.Handler {
middleware := func(w http.ResponseWriter, r *http.Request) {
// All requests: verify they have a CSRF cookie, create one if not.
var token string
cookie, err := r.Cookie(constants.CSRFCookieName)
if err == nil {
token = cookie.Value
}
// Generate a token cookie if not found.
if len(token) < 8 || err != nil {
token = uuid.NewV4().String()
cookie = &http.Cookie{
Name: constants.CSRFCookieName,
Value: token,
Expires: time.Now().Add(24 * time.Hour),
}
http.SetCookie(w, cookie)
}
// Add the CSRF token to the request context. This makes it immediately
// available on FIRST page load, when the cookie hasn't been sent back
// from the browser yet.
ctx := context.WithValue(r.Context(), session.CSRFKey, token)
// POST requests: verify token from form parameter.
if r.Method == http.MethodPost {
compare := r.FormValue(constants.CSRFFormName)
if compare != token {
responses.Panic(w, http.StatusForbidden, "CSRF token failure.")
return
}
}
next.ServeHTTP(w, r.WithContext(ctx))
}
return http.HandlerFunc(middleware)
}