(r *http.Request)
| 56 | } |
| 57 | |
| 58 | func canSkipCSRFMiddleware(r *http.Request) bool { |
| 59 | authVal := r.Header.Get("Authorization") |
| 60 | if !strings.HasPrefix(authVal, "Bearer ") { |
| 61 | return false // When using an empty Authorization header, we may still want to set the CSRF token cookie. |
| 62 | } |
| 63 | tokenType, _, _, err := auth.SplitToken(strings.TrimPrefix(authVal, "Bearer ")) |
| 64 | if err != nil { |
| 65 | return false // When using an unsupported Bearer token, we may still want to set the CSRF token cookie. |
| 66 | } |
| 67 | switch tokenType { |
| 68 | case auth.APIKey, auth.AccessToken: |
| 69 | return true // When the caller uses a Bearer token of type API key or Access Token, we can skip CSRF middleware. |
| 70 | default: |
| 71 | return false |
| 72 | } |
| 73 | } |
| 74 | |
| 75 | func canSkipCSRFCheck(r *http.Request) bool { |
| 76 | authVal := r.Header.Get("Authorization") |
no test coverage detected