csrf

Documentation

Overview

Description: CSRF protection middleware for Go web servers. The CSRF middleware generates and validates tokens to prevent cross-site request forgery attacks. The CSRF token is set in an HTTP-only cookie(to prevent access via JavaScript) and and a hidden form field. The middleware checks the token in the form or request headers against the cookie. The CSRF token is generated using 32 random bytes encoded in base64. Access to the token is provided in the context using the key "csrf_token".

Index

• Variables
• func CreateToken() (string, error)
• func New(store sessions.Store, secureCookie bool) rex.Middleware

Variables

var (
	ErrMissingToken = errors.New("missing CSRF token")
	ErrInvalidToken = errors.New("invalid CSRF token")
)

Functions

func CreateToken

func CreateToken() (string, error)

Generates a random CSRF token.

func New

func New(store sessions.Store, secureCookie bool) rex.Middleware

Middleware sets and verifies CSRF tokens using HTTP-only cookies and forms. Set the CSRF token in the form using {{ .csrf_token }} in the template. If secureCookie is true, the csrf token is transmitted only in a secure context (https).