Function ClearExtraCsrfCookies

pkg/cookies/csrf.go:172–210

ClearExtraCsrfCookies limits the amount of existing CSRF cookies by deleting an excess of cookies controlled through the option CSRFPerRequestLimit

(opts *options.Cookie, rw http.ResponseWriter, req *http.Request)

// ClearExtraCsrfCookies limits the amount of existing CSRF cookies by deleting
// an excess of cookies controlled through the option CSRFPerRequestLimit
func ClearExtraCsrfCookies(opts *options.Cookie, rw http.ResponseWriter, req *http.Request) {
	if !opts.CSRFPerRequest || opts.CSRFPerRequestLimit <= 0 {
		return
	}

	cookies := req.Cookies()
	existingCsrfCookies := []*http.Cookie{}
	startsWith := fmt.Sprintf("%v_", opts.Name)

	// determine how many csrf cookies we have
	for _, cookie := range cookies {
		if strings.HasPrefix(cookie.Name, startsWith) && strings.HasSuffix(cookie.Name, "_csrf") {
			existingCsrfCookies = append(existingCsrfCookies, cookie)
		}
	}

	// short circuit return
	if len(existingCsrfCookies) <= opts.CSRFPerRequestLimit {
		return
	}

	decodedCookies := []*csrf{}
	for _, cookie := range existingCsrfCookies {
		decodedCookie, err := decodeCSRFCookie(cookie, opts)
		if err != nil {
			continue
		}
		decodedCookies = append(decodedCookies, decodedCookie)
	}

	// delete the X oldest cookies
	slices.SortStableFunc(decodedCookies, func(a, b *csrf) int {
		return a.clock().Compare(b.clock())
	})

	for i := 0; i < len(decodedCookies)-opts.CSRFPerRequestLimit; i++ {
		decodedCookies[i].ClearCookie(rw, req)
	}
}

// ClearCookie removes the CSRF cookie
func (c *csrf) ClearCookie(rw http.ResponseWriter, req *http.Request) {