Any plans on a csrf middleware? about contrib HOT 6 CLOSED

Later I found a fork of this library github.com/utrack/gin-csrf that has been adapted to work with gin-contrib sessions.

However I have found another library nosurf which seems to be much more mature than gin-csrf.

from contrib.

+1

from contrib.

@robvdl
There is already https://github.com/gin-gonic/nosurf

Simplified example

func main() {
     r := gin.Default()

     csrf := nosurf.New(r)
     csrf.SetFailureHandler(http.HandlerFunc(csrfFailHandler))

     http.ListenAndServe(":8000", csrf)
}

func csrfFailHandler(w http.ResponseWriter, r *http.Request) {
    fmt.Fprintf(w, "%s\n", nosurf.Reason(r))
}

func DisplayForm(c *gin.Context) {
   // in your form
   // <input type="hidden" name="csrf_token" value="{{ csrf_token }}">
    c.HTML(200, "foo.html", pongo2.Context{"csrf_token":    nosurf.Token(c.Request)})
}

from contrib.

@iwanbk

Yep, that's exactly what I have already been doing, I found that out not long after I wrote this issue, so I am not sure a csrf middleware is really needed in contrib, should we close this issue?

from contrib.

should we close this issue?

Yes, we should instead improve readme/docs of https://github.com/gin-gonic/nosurf

from contrib.

Please note, at this moment this fork is far behind justinas/nosurf.

from contrib.