gobuffalo / mw-csrf

Buffalo CSRF Middleware

Buffalo Documentation

This is the repository for https://www.gobuffalo.io, the official website of the Buffalo ecosystem.

This documentation contains:

• The Buffalo Documentation
• The Pop Documentation

Contributing

Contributing to this documentation site is a great, and easy, way to help make Buffalo better!

Note that this repository is only about Buffalo ecosystem documentation. If you want to contribute to the ecosystem itself, please refer to the concerned repository:

• Buffalo
• Buffalo CLI
• Pop
• Plush

See the contribution guide for more info about how to contribute.

mw-csrf's Issues

Report a typo not a bug

https://github.com/gobuffalo/mw-csrf/blob/master/csrf.go#L219

func unmask(issued []byte) []byte {
	// Issued tokens are always masked and combined with the pad.
	if len(issued) != tokenLength*2 {
		return nil
	}

	// We now know the length of the byte slice.
	otp := issued[tokenLength:]
	masked := issued[:tokenLength]

	// Unmask the token by XOR'ing it against the OTP used to mask it.
	return xorToken(otp, masked)
}

The mask append the xored token to otp, but the unmask func treats xored at the end.

As the result is the front half xor the latter half，the result is right.

MW-CSRF ignores POST/PUT/DELETE with Content-Type: application/json

I'm developing backend via GoBuffalo, hence I need CSRF check for POST/DELETE/PUT methods but MW-CSRF simply ignore these requests with Content-Type: application/json due to:

  htmlTypes   = []string{"html", "form", "plain", "*/*"}
  .
  .
  .
  req := c.Request()
  ct := req.Header.Get("Content-Type")
  if len(ct) == 0 {
    ct = req.Header.Get("Accept")
  }
  // ignore non-html requests
  if ct != "" && !contains(htmlTypes, ct) {
    return next(c)
  }

Note: I'm using "github.com/rs/cors" too, the FrontEnd is under development using ReactJS.
What could I do?

X-CSRF-Token Header cannot work

With the actual implementation of http.Header, which basically wraps textproto.MIMEHeader the here defined header field X-CSRF-Token can never exists in an http.Header, because textproto.MIMEHeader applies textproto.CanonicalMIMEHeaderKey to every header key, inserted.

However, all would be fine, when X-CSRF-Token would be renamed to X-Csrf-Token.

Disable csrf protection for certain endpoints

Given my limited knowledge regarding go (just started a few weeks ago):

How to disable csrf for certain endpoints? I've tried to Middleware.Skip but somehow csrf is not a real middleware function.

Is it safe to use any other csrf packet?

Only 1 or to endpoints are API endpoints and I don't feel like put these into another module