website/pkg/middleware/csrf.go
Noah 8419958b25 Likes on Comments, and other minor improvements
* Add "Like" buttons to comments and forum posts.
* Make "private" profiles more private (logged-in users see only their profile
  pic, display name, and can friend request or message, if they are not approved
  friends of the private user)
* Add "logged-out view" visibility setting to profiles: to share a link to your
  page on other sites. Opt-in setting - default is login required to view your
  public profile page.
* CSRF cookie fix.
* Updated FAQ & Privacy pages.
2022-08-29 20:00:15 -07:00

68 lines
1.9 KiB
Go

package middleware
import (
"context"
"net/http"
"code.nonshy.com/nonshy/website/pkg/config"
"code.nonshy.com/nonshy/website/pkg/log"
"code.nonshy.com/nonshy/website/pkg/session"
"code.nonshy.com/nonshy/website/pkg/templates"
"github.com/google/uuid"
)
// CSRF middleware. Other places to look: pkg/session/session.go, pkg/templates/template_funcs.go
func CSRF(handler http.Handler) http.Handler {
return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
// Get or create the cookie CSRF value.
token := MakeCSRFCookie(r, w)
ctx := context.WithValue(r.Context(), session.CSRFKey, token)
// If it's a JSON post, allow it thru.
if r.Header.Get("Content-Type") == "application/json" {
handler.ServeHTTP(w, r.WithContext(ctx))
return
}
// If we are running a POST request, validate the CSRF form value.
if r.Method != http.MethodGet {
r.ParseMultipartForm(config.MultipartMaxMemory)
check := r.FormValue(config.CSRFInputName)
if check != token {
log.Error("CSRF mismatch! %s <> %s", check, token)
templates.MakeErrorPage(
"CSRF Error",
"An error occurred while processing your request. Please go back and try again.",
http.StatusForbidden,
)(w, r.WithContext(ctx))
return
}
}
handler.ServeHTTP(w, r.WithContext(ctx))
})
}
// MakeCSRFCookie gets or creates the CSRF cookie and returns its value.
func MakeCSRFCookie(r *http.Request, w http.ResponseWriter) string {
// Has a token already?
cookie, err := r.Cookie(config.CSRFCookieName)
if err == nil {
// log.Debug("MakeCSRFCookie: user has token %s", cookie.Value)
return cookie.Value
}
// Generate a new CSRF token.
token := uuid.New().String()
cookie = &http.Cookie{
Name: config.CSRFCookieName,
Value: token,
HttpOnly: true,
Path: "/",
}
// log.Debug("MakeCSRFCookie: giving cookie value %s to user", token)
http.SetCookie(w, cookie)
return token
}