csrf

Documentation

Overview

Package csrf provides Cross-Site Request Forgery protection using the double-submit-cookie pattern. A random token is issued in a cookie and, for state-changing requests, must be echoed back in a request header or form field. Requests whose submitted token does not match the cookie are rejected with 403 Forbidden.

Index

• func New(opts ...Options) express.Handler
• func Token(req *express.Request) string
• type Options

Functions

func New

func New(opts ...Options) express.Handler

New returns CSRF protection middleware. It ensures a token cookie exists on every request and, for unsafe methods (POST/PUT/PATCH/DELETE), verifies that the token submitted in the configured header or form field matches the cookie. On mismatch it responds 403 and does not call next.

func Token

func Token(req *express.Request) string

Token returns the CSRF token associated with the current request, or "" if the middleware did not run.

Types

type Options

type Options struct {
	// CookieName is the name of the cookie that stores the token
	// (default "csrf").
	CookieName string
	// Header is the request header inspected for the submitted token
	// (default "X-CSRF-Token").
	Header string
	// FormField is the form field inspected for the submitted token when the
	// header is absent (default "_csrf").
	FormField string
	// MaxAge sets the token cookie Max-Age in seconds (0 = session cookie).
	MaxAge int
	// Secure marks the token cookie Secure (HTTPS only).
	Secure bool
}

Options configures the CSRF middleware.