Better support for trusted origins

Author: dorsha

.gitignore

@@ -1 +1,3 @@
 coverage.coverprofile
+.vscode/settings.json
+.history

csrf.go

@@ -7,6 +7,7 @@ import (
 	"net/http"
 	"net/url"
 	"slices"
+	"strings"
 
 	"github.com/gorilla/securecookie"
 )
@@ -105,7 +106,7 @@ type options struct {
 	FieldName      string
 	ErrorHandler   http.Handler
 	CookieName     string
-	TrustedOrigins []string
+	TrustedOrigins string
 }
 
 // Protect is HTTP middleware that provides Cross-Site Request Forgery
@@ -276,6 +277,8 @@ func (cs *csrf) ServeHTTP(w http.ResponseWriter, r *http.Request) {
 			requestURL.Host = r.Host
 		}
 
+		trustedOrigins := strings.Split(cs.opts.TrustedOrigins, ",")
+
 		// if we have an Origin header, check it against our allowlist
 		origin := r.Header.Get("Origin")
 		if origin != "" {
@@ -285,7 +288,9 @@ func (cs *csrf) ServeHTTP(w http.ResponseWriter, r *http.Request) {
 				cs.opts.ErrorHandler.ServeHTTP(w, r)
 				return
 			}
-			if !sameOrigin(&requestURL, parsedOrigin) && !slices.Contains(cs.opts.TrustedOrigins, parsedOrigin.Host) {
+			if !sameOrigin(&requestURL, parsedOrigin) && !slices.ContainsFunc(trustedOrigins, func(trustedOrigin string) bool {
+				return trustedOrigin == "*" || strings.HasSuffix(parsedOrigin.Host, trustedOrigin)
+			}) {
 				r = envError(r, ErrBadOrigin)
 				cs.opts.ErrorHandler.ServeHTTP(w, r)
 				return
@@ -318,7 +323,9 @@ func (cs *csrf) ServeHTTP(w http.ResponseWriter, r *http.Request) {
 			// If the request is being served via TLS and the Referer is not the
 			// same origin, check the domain against our allowlist. We only
 			// check when we have host information from the referer.
-			if referer.Host != "" && referer.Host != r.Host && !slices.Contains(cs.opts.TrustedOrigins, referer.Host) {
+			if referer.Host != "" && referer.Host != r.Host && !slices.ContainsFunc(trustedOrigins, func(trustedOrigin string) bool {
+				return trustedOrigin == "*" || strings.HasSuffix(referer.Host, trustedOrigin)
+			}) {
 				r = envError(r, ErrBadReferer)
 				cs.opts.ErrorHandler.ServeHTTP(w, r)
 				return

options.go

@@ -125,7 +125,7 @@ func CookieName(name string) Option {
 // from a different domain than the API server - to correctly pass a CSRF check.
 //
 // You should only provide origins you own or have full control over.
-func TrustedOrigins(origins []string) Option {
+func TrustedOrigins(origins string) Option {
 	return func(cs *csrf) {
 		cs.opts.TrustedOrigins = origins
 	}