A stateless CSRF middleware for Go. It works by relying the
presence of the Origin
header. It will also
fall back to Referer
if that's provided and Origin
isn't, but it has no mechanic for embedding a form token.
import (
"github.com/brandur/csrf"
)
func main() {
var handler = http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {})
handler = csrf.Protect(
csrf.AllowedOrigin("https://example.com")
)(s)
...
}