Skip to content

C
canifa_note
Unverified Commit c9bb2b78 authored by boojack's avatar boojack Committed by GitHub
Browse files
Options

chore: fix CSRF (#876)

parent 64e5c343
Hide whitespace changes
Inline Side-by-side
Showing with 5 additions and 0 deletions
server/acl.go
View file @ c9bb2b78
...@@ -27,6 +27,7 @@ func setUserSession(ctx echo.Context, user *api.User) error { ...@@ -27,6 +27,7 @@ func setUserSession(ctx echo.Context, user *api.User) error {
Path: "/", Path: "/",
MaxAge: 3600 * 24 * 30, MaxAge: 3600 * 24 * 30,
HttpOnly: true, HttpOnly: true,
SameSite: http.SameSiteStrictMode,
} }
sess.Values[userIDContextKey] = user.ID sess.Values[userIDContextKey] = user.ID
err := sess.Save(ctx.Request(), ctx.Response()) err := sess.Save(ctx.Request(), ctx.Response())
......
server/server.go
View file @ c9bb2b78
...@@ -36,6 +36,10 @@ func NewServer(profile *profile.Profile) *Server { ...@@ -36,6 +36,10 @@ func NewServer(profile *profile.Profile) *Server {
`"status":${status},"error":"${error}"}` + "\n", `"status":${status},"error":"${error}"}` + "\n",
})) }))
e.Use(middleware.CSRFWithConfig(middleware.CSRFConfig{
TokenLookup: "cookie:_csrf",
}))
e.Use(middleware.CORS()) e.Use(middleware.CORS())
e.Use(middleware.TimeoutWithConfig(middleware.TimeoutConfig{ e.Use(middleware.TimeoutWithConfig(middleware.TimeoutConfig{
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment