yaha/memos
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

chore: fix CSRF (#876)

Browse Source
This commit is contained in:
boojack 2022-12-30 00:17:19 +08:00 committed by GitHub
parent 64e5c343c5
commit c9bb2b785d
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
2 changed files with 5 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

1
server/acl.go
View File

@ -27,6 +27,7 @@ func setUserSession(ctx echo.Context, user *api.User) error {
Path: "/",
MaxAge: 3600 * 24 * 30,
HttpOnly: true,
SameSite: http.SameSiteStrictMode,
}
sess.Values[userIDContextKey] = user.ID
err := sess.Save(ctx.Request(), ctx.Response())

4
server/server.go
View File

@ -36,6 +36,10 @@ func NewServer(profile *profile.Profile) *Server {
`"status":${status},"error":"${error}"}` + "\n",
}))
e.Use(middleware.CSRFWithConfig(middleware.CSRFConfig{
TokenLookup: "cookie:_csrf",
}))
e.Use(middleware.CORS())
e.Use(middleware.TimeoutWithConfig(middleware.TimeoutConfig{