ede9467a
csrf: the shared same-origin guard
Five services carried their own copy of the Origin/Referer check and the copies had drifted, not only in wording: tokens, cover and bench apply it as router-wide middleware, while dolt and specs call a predicate from individual handlers, so a form added to either of those goes out unguarded. Require is therefore the API this package leads with, and SameOrigin is the escape hatch for a service migrating one route at a time.
Eugene Blikh <bigbes@gmail.com> — 2026-08-08 19:14:13 UTC
Commit ede9467aeff49bfa6205b12e16914dac560eb790 —
view raw patch
Parent(s):
4d7f4c4a
| File | Status | + | − |
|---|---|---|---|
csrf/csrf.go
|
A | +230 | |
csrf/csrf_test.go
|
A | +424 |