GoのCSRF対策
https://future-architect.github.io/articles/20250804a/
https://blog.jxck.io/entries/2024-04-26/csrf.html
ginでの実装demo(無理くり)
code:go
import (
"log/slog"
"net/http"
"github.com/gin-gonic/gin"
)
func CSRFMiddleware(logger *slog.Logger) gin.HandlerFunc {
// CSRF保護の設定
csrfProtection := http.NewCrossOriginProtection()
// 信頼オリジンの設定
err := csrfProtection.AddTrustedOrigin("http://localhost:3000")
if err != nil {
logger.Error("not add origin", "error", err)
}
// カスタムdenyハンドラの設定
denyHandler := http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
logger.Error("Origin Blocked", "origin", r.Header.Get("Origin"), "path", r.URL.Path)
http.Error(w, "Forbidden", http.StatusForbidden)
})
csrfProtection.SetDenyHandler(denyHandler)
return func(c *gin.Context) {
csrfProtection.Handler(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
c.Next()
})).ServeHTTP(c.Writer, c.Request)
}
}