// CSRFWithConfig returns a CSRF middleware with config.
// See `CSRF(fasthttp.RequestHandler)`.
CSRFWithConfig returns a CSRF middleware with config.
See `CSRF(fasthttp.RequestHandler)`.
// CSRFWithConfig returns a CSRF middleware with config . // See ` CSRF ( fasthttp . RequestHandler ) ` .
func CSRFWithConfig(config CSRFConfig) func(fasthttp.RequestHandler) fasthttp.RequestHandler {
	if config.TokenLength == 0 {
		config.TokenLength = DefaultCSRFConfig.TokenLength
	}
	if config.TokenLookup == "" {
		config.TokenLookup = DefaultCSRFConfig.TokenLookup
	}
	if config.ContextKey == "" {
		config.ContextKey = DefaultCSRFConfig.ContextKey
	}
	if config.CookieName == "" {
		config.CookieName = DefaultCSRFConfig.CookieName
	}
	if config.CookieMaxAge == 0 {
		config.CookieMaxAge = DefaultCSRFConfig.CookieMaxAge
	}
	parts := strings.Split(config.TokenLookup, ":")
	extractor := csrfTokenFromHeader(parts[1])
	switch parts[0] {
	case "form":
		extractor = csrfTokenFromForm(parts[1])
	case "query":
		extractor = csrfTokenFromQuery(parts[1])
	}
	return func(next fasthttp.RequestHandler) fasthttp.RequestHandler {
		return fasthttp.RequestHandler(func(ctx *fasthttp.RequestCtx) {
			req := ctx.Request
			method := req.Header.Method()
			token := req.Header.Cookie(config.CookieName)
			if sliceIsEmpty(token) {
				token = randomToken(config.TokenLength)
			}
			switch string(method) {
			case fasthttp.MethodGet, fasthttp.MethodHead, fasthttp.MethodOptions, fasthttp.MethodTrace:
			default:
				clientToken, err := extractor(ctx)
				if err != nil {
					ctx.Error(err.Error(), fasthttp.StatusBadRequest)
					return
				}
				if !validateCSRFToken(token, clientToken) {
					ctx.Error(InvalidCSRFToken, fasthttp.StatusForbidden)
					return
				}
			}
			cookie := new(fasthttp.Cookie)
			cookie.SetKey(config.CookieName)
			cookie.SetValueBytes(token)
			if config.CookiePath != "" {
				cookie.SetPath(config.CookiePath)
			}
			if config.CookieDomain != "" {
				cookie.SetDomain(config.CookieDomain)
			}
			cookie.SetExpire(time.Now().Add(time.Duration(config.CookieMaxAge) * time.Second))
			cookie.SetSecure(config.CookieSecure)
			cookie.SetHTTPOnly(config.CookieHTTPOnly)
			ctx.SetUserValue(config.ContextKey, token)
			ctx.Response.Header.SetCookie(cookie)
			ctx.Response.Header.Add("Vary", "Cookie")
			next(ctx)
		})
	}
}
func CSRFWithConfig ( config CSRFConfig ) func ( fasthttp . RequestHandler ) fasthttp . RequestHandler { if config . TokenLength == 0 { config . TokenLength = DefaultCSRFConfig . TokenLength } if config . TokenLookup == " " { config . TokenLookup = DefaultCSRFConfig . TokenLookup } if config . ContextKey == " " { config . ContextKey = DefaultCSRFConfig . ContextKey } if config . CookieName == " " { config . CookieName = DefaultCSRFConfig . CookieName } if config . CookieMaxAge == 0 { config . CookieMaxAge = DefaultCSRFConfig . CookieMaxAge } parts := strings . Split ( config . TokenLookup , " " ) extractor := csrfTokenFromHeader ( parts [ 1 ] ) switch parts [ 0 ] { case " " : extractor = csrfTokenFromForm ( parts [ 1 ] ) case " " : extractor = csrfTokenFromQuery ( parts [ 1 ] ) } return func ( next fasthttp . RequestHandler ) fasthttp . RequestHandler { return fasthttp . RequestHandler ( func ( ctx * fasthttp . RequestCtx ) { req := ctx . Request method := req . Header . Method ( ) token := req . Header . Cookie ( config . CookieName ) if sliceIsEmpty ( token ) { token = randomToken ( config . TokenLength ) } switch string ( method ) { case fasthttp . MethodGet , fasthttp . MethodHead , fasthttp . MethodOptions , fasthttp . MethodTrace : default : clientToken , err := extractor ( ctx ) if err != nil { ctx . Error ( err . Error ( ) , fasthttp . StatusBadRequest ) return } if ! validateCSRFToken ( token , clientToken ) { ctx . Error ( InvalidCSRFToken , fasthttp . StatusForbidden ) return } } cookie := new ( fasthttp . Cookie ) cookie . SetKey ( config . CookieName ) cookie . SetValueBytes ( token ) if config . CookiePath != " " { cookie . SetPath ( config . CookiePath ) } if config . CookieDomain != " " { cookie . SetDomain ( config . CookieDomain ) } cookie . SetExpire ( time . Now ( ) . Add ( time . Duration ( config . CookieMaxAge ) * time . Second ) ) cookie . SetSecure ( config . CookieSecure ) cookie . SetHTTPOnly ( config . CookieHTTPOnly ) ctx . SetUserValue ( config . ContextKey , token ) ctx . Response . Header . SetCookie ( cookie ) ctx . Response . Header . Add ( " " , " " ) next ( ctx ) } ) } }
CSRFWithConfig returns a CSRF middleware with config.
CSRFWithConfig returns a CSRF middleware with config .
// Initialize // Generate token // Validate token only for requests which are not defined as 'safe' by RFC7231 // Set CSRF cookie