pkg.gl

package

0.1.0

Documentation: pkg.go.dev

# README

Offers stateless protection against CSRF attacks for Go web applications.

Checks Origin header was sent and matches the Host header.
Falls back to a URL-safe and secure HMAC token stored in a HTTP-only and secured cookie.
Protects all HTTP requests that would potentially mutate data: POST, PUT, DELETE and PATCH.
If you use CORS, make sure to enable Access-Control-Allow-Credentials, so that the cookie containing the HMAC token is sent to your backend service and can be verified by this handler.
Allows content to be cacheable by CDNs as the token is sent in a cookie and not on the HTML document.

HTTP Origin header is the best way to deflect CSRF attacks, though, some old browsers may not support it, therefore we provide a fallback to stateless HMAC tokens.
TLS everywhere has been made possible by https://letsencrypt.org, so this handler only sends the CSRF cookie over TLS.
Synchronizer Token Pattern is another way of protection, however, this handler offers a simpler and equally effective protection.
This handler depends on a session or user ID, so you must implement the Session interface to allow the handler to retrieve the session ID from wherever it is being stored.

To make things a bit more difficult to malicious folks, take a look at defining your own Content Security Policy