A web blog and personal homepage engine written in Go.
You can not select more than 25 topics Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.

55 lines
1.5 KiB

package middleware
import (
uuid "github.com/satori/go.uuid"
// CSRF prevents Cross-Site Request Forgery.
// All "POST" requests are required to have an "_csrf" variable passed in which
// matches the "csrf_token" HTTP cookie with their request.
func CSRF(next http.Handler) http.Handler {
middleware := func(w http.ResponseWriter, r *http.Request) {
// All requests: verify they have a CSRF cookie, create one if not.
var token string
cookie, err := r.Cookie(constants.CSRFCookieName)
if err == nil {
token = cookie.Value
// Generate a token cookie if not found.
if len(token) < 8 || err != nil {
token = uuid.NewV4().String()
cookie = &http.Cookie{
Name: constants.CSRFCookieName,
Value: token,
Expires: time.Now().Add(24 * time.Hour),
http.SetCookie(w, cookie)
// Add the CSRF token to the request context. This makes it immediately
// available on FIRST page load, when the cookie hasn't been sent back
// from the browser yet.
ctx := context.WithValue(r.Context(), session.CSRFKey, token)
// POST requests: verify token from form parameter.
if r.Method == http.MethodPost {
compare := r.FormValue(constants.CSRFFormName)
if compare != token {
responses.Panic(w, http.StatusForbidden, "CSRF token failure.")
next.ServeHTTP(w, r.WithContext(ctx))
return http.HandlerFunc(middleware)