csrf protection

Author: avoidik

cmd/web/handlers.go

@@ -6,7 +6,6 @@ import (
 	"os"
 	"path/filepath"
 	"strconv"
-	"strings"
 
 	"snippetbox.org/pkg/forms"
 	"snippetbox.org/pkg/models"
@@ -105,16 +104,6 @@ func (app *App) VersionInfo(w http.ResponseWriter, r *http.Request) {
 	http.ServeFile(w, r, verFile)
 }
 
-func DisableIndex(next http.Handler) http.Handler {
-	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		if strings.HasSuffix(r.URL.Path, "/") {
-			http.Error(w, "Nothing to see here", http.StatusNotFound)
-			return
-		}
-		next.ServeHTTP(w, r)
-	})
-}
-
 func (app *App) SignupUser(w http.ResponseWriter, r *http.Request) {
 	app.RenderHtml(w, r, "signup.page.html", &HtmlData{
 		Form: &forms.SignupUser{},

cmd/web/middleware.go

@@ -3,6 +3,9 @@ package main
 import (
 	"log"
 	"net/http"
+	"strings"
+
+	"github.com/justinas/nosurf"
 )
 
 func LogRequest(next http.Handler) http.Handler {
@@ -37,3 +40,27 @@ func (app *App) RequireLogin(next http.Handler) http.Handler {
 		next.ServeHTTP(w, r)
 	})
 }
+
+func NoSurf(next http.Handler) http.Handler {
+	csrfHandler := nosurf.New(next)
+	csrfHandler.SetBaseCookie(http.Cookie{
+		HttpOnly: true,
+		Path:     "/",
+		Secure:   true,
+	})
+	return csrfHandler
+}
+
+func DisableIndex(next http.Handler) http.Handler {
+	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		if strings.HasSuffix(r.URL.Path, "/") {
+			http.Error(w, "Nothing to see here", http.StatusNotFound)
+			return
+		}
+		next.ServeHTTP(w, r)
+	})
+}
+
+func StripStatic(next http.Handler) http.Handler {
+	return http.StripPrefix("/static", next)
+}

cmd/web/routes.go

@@ -10,20 +10,20 @@ import (
 func (app *App) Routes() http.Handler {
 	mux := pat.New()
 
-	mux.Get("/", http.HandlerFunc(app.Home))
+	mux.Get("/", alice.New(NoSurf).Then(http.HandlerFunc(app.Home)))
 
-	mux.Get("/snippet/new", alice.New(app.RequireLogin).Then(http.HandlerFunc(app.NewSnippet)))
-	mux.Post("/snippet/new", alice.New(app.RequireLogin).Then(http.HandlerFunc(app.CreateSnippet)))
-	mux.Get("/snippet/:id", http.HandlerFunc(app.ShowSnippet))
+	mux.Get("/snippet/new", alice.New(app.RequireLogin, NoSurf).Then(http.HandlerFunc(app.NewSnippet)))
+	mux.Post("/snippet/new", alice.New(app.RequireLogin, NoSurf).Then(http.HandlerFunc(app.CreateSnippet)))
+	mux.Get("/snippet/:id", alice.New(NoSurf).Then(http.HandlerFunc(app.ShowSnippet)))
 
-	mux.Get("/user/signup", http.HandlerFunc(app.SignupUser))
-	mux.Post("/user/signup", http.HandlerFunc(app.CreateUser))
-	mux.Get("/user/login", http.HandlerFunc(app.LoginUser))
-	mux.Post("/user/login", http.HandlerFunc(app.VerifyUser))
-	mux.Post("/user/logout", alice.New(app.RequireLogin).Then(http.HandlerFunc(app.LogoutUser)))
+	mux.Get("/user/signup", alice.New(NoSurf).Then(http.HandlerFunc(app.SignupUser)))
+	mux.Post("/user/signup", alice.New(NoSurf).Then(http.HandlerFunc(app.CreateUser)))
+	mux.Get("/user/login", alice.New(NoSurf).Then(http.HandlerFunc(app.LoginUser)))
+	mux.Post("/user/login", alice.New(NoSurf).Then(http.HandlerFunc(app.VerifyUser)))
+	mux.Post("/user/logout", alice.New(app.RequireLogin, NoSurf).Then(http.HandlerFunc(app.LogoutUser)))
 
 	fileServer := http.FileServer(http.Dir(app.staticDir))
-	mux.Get("/static/", http.StripPrefix("/static", DisableIndex(fileServer)))
+	mux.Get("/static/", alice.New(StripStatic, DisableIndex).Then(fileServer))
 
 	mux.Get("/version", http.HandlerFunc(app.VersionInfo))
 

cmd/web/views.go

@@ -7,16 +7,18 @@ import (
 	"path/filepath"
 	"time"
 
+	"github.com/justinas/nosurf"
 	"snippetbox.org/pkg/models"
 )
 
 type HtmlData struct {
-	Form     interface{}
-	Path     string
-	Flash    string
-	LoggedIn bool
-	Snippet  *models.Snippet
-	Snippets []*models.Snippet
+	CSRFtoken string
+	Form      interface{}
+	Path      string
+	Flash     string
+	LoggedIn  bool
+	Snippet   *models.Snippet
+	Snippets  []*models.Snippet
 }
 
 func humanDate(t time.Time) string {
@@ -30,6 +32,8 @@ func (app *App) RenderHtml(w http.ResponseWriter, r *http.Request, page string,
 
 	data.Path = r.URL.Path
 
+	data.CSRFtoken = nosurf.Token(r)
+
 	var err error
 	data.LoggedIn, err = app.LoggedIn(r)
 	if err != nil {

glide.lock

@@ -9,3 +9,4 @@ import:
 - package: golang.org/x/crypto
   subpackages:
   - bcrypt
+- package: github.com/justinas/nosurf

glide.yaml

@@ -20,6 +20,7 @@ <h1><a href="/">Snippetbox</a></h1>
                 New Snippet
             </a>
             <form action="/user/logout" method="POST">
+                <input type="hidden" name="csrf_token" value="{{.CSRFtoken}}">
                 <button>Logout</button>
             </form>
             {{else}}

ui/html/base.html

@@ -5,6 +5,7 @@
     <div class="flash">{{.}}</div>
     {{end}}
     <form action="/user/login" method="POST" novalidate>
+        <input type="hidden" name="csrf_token" value="{{.CSRFtoken}}">
         {{with .Form}}
             {{with .Failures.Generic}}
             <div class="error">{{.}}</div>
@@ -23,7 +24,7 @@
                 {{end}}
                 <input type="password" name="password">
             </div>
-            <div>
+            <div>                
                 <input type="submit" value="Submit">
             </div>
         {{end}}

ui/html/login.page.html

@@ -2,6 +2,7 @@
 
 {{define "page-body"}}
 <form action="/snippet/new" method="POST">
+    <input type="hidden" name="csrf_token" value="{{.CSRFtoken}}">
     {{with .Form}}
     <div>
         <label>Title:</label>

ui/html/new.page.html

@@ -2,6 +2,7 @@
 
 {{define "page-body"}}
 <form action="/user/signup" method="POST" novalidate>
+    <input type="hidden" name="csrf_token" value="{{.CSRFtoken}}">
     {{with .Form}}
         <div>
             <label>Name:</label>