Function CSRF

pkg/webmiddleware/csrf.go:32–56

CSRF returns a middleware that enables CSRF protection via a sync token. The skipCheck parameter can be used to skip CSRF protection based on the request interface.

(authKey []byte, opts ...csrf.Option)

// skipCheck parameter can be used to skip CSRF protection based on the request
// interface.
func CSRF(authKey []byte, opts ...csrf.Option) MiddlewareFunc {
	return func(next http.Handler) http.Handler {
		return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
			if canSkipCSRFMiddleware(r) {
				next.ServeHTTP(w, r)
				return
			}
			defaultOptions := []csrf.Option{
				csrf.SameSite(csrf.SameSiteLaxMode),
				csrf.Secure(r.URL.Scheme == "https"),
				csrf.ErrorHandler(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
					// In some cases we do want to execute the CSRF middleware, so that a CSRF token is set
					// but we don't want to enforce CSRF token validation.
					if canSkipCSRFCheck(r) {
						next.ServeHTTP(w, r)
						return
					}
					webhandlers.Error(w, r, errInvalidCSRFToken.New())
				})),
			}
			handler := csrf.Protect(authKey, append(defaultOptions, opts...)...)(next)
			handler.ServeHTTP(w, r)
		})
	}
}

func canSkipCSRFMiddleware(r *http.Request) bool {
	authVal := r.Header.Get("Authorization")