Wrap router with http.CrossOriginProtection for CSRF defence#102
Merged
Conversation
Add Go 1.25's http.NewCrossOriginProtection().Handler to the global middleware chain. Previously the only CSRF defence on the cookie session was SameSite=Strict, which Firefox does not enforce by default and which subdomain attacks can bypass. The middleware checks Sec-Fetch-Site (forbidden header, set by all major browsers since 2023) with an Origin/Host fallback. Same-origin htmx requests pass through; non-browser clients (no Sec-Fetch-Site) also pass through, so token-authenticated /kv/* API consumers are unaffected.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Adds Go 1.25's
http.NewCrossOriginProtection().Handlerto the global middleware chain inapp/server/server.go. One line of code, ~50 lines of test.Why
Today the only CSRF defence on the cookie session is
SameSite=Strict, which has known gaps:SameSite=Laxon its release channel and has no plans to change in 2025SameSiteentirely -- it operates on site (registrable domain), not origin, so an attacker controlling any subdomain on the same registrable domain can issue same-site POSTs with the session cookie attachedSameSiteavailable across sites for 120s after navigationhttp.CrossOriginProtectionchecks the browser-setSec-Fetch-Siteheader (a forbidden header JS cannot forge, shipped in all major browsers since 2023) with anOriginvsHostfallback for older clients. UnlikeSameSite, it distinguishes same-origin from same-site -- subdomain attacks are blocked.OWASP elevated this algorithm from defence-in-depth to a primary CSRF defence in its cheatsheet in December 2025.
What changed
app/server/server.go-- one line in therouter.Use(...)blockapp/server/server_test.go-- newTestServer_CrossOriginProtectioncovering same-origin / cross-site / origin-host-mismatch / non-browser casesBehaviour notes
Sec-Fetch-Site: same-originis sent and the middleware passes them through. Verified end-to-end via the new test./kv/*API consumers (curl, scripts, server-to-server, the Go client library) do not sendSec-Fetch-Site-- the middleware treats this as a non-browser request and lets them through. Token-authenticated API integrations are unaffected.fetch()against/kv/fooor/web/keys) is now rejected with 403 before reaching the handler.References