diff options
| -rw-r--r-- | srv/src/http/csrf.go | 31 |
1 files changed, 23 insertions, 8 deletions
diff --git a/srv/src/http/csrf.go b/srv/src/http/csrf.go index d0f7b6a..a64e37e 100644 --- a/srv/src/http/csrf.go +++ b/srv/src/http/csrf.go @@ -2,23 +2,38 @@ package http import ( "errors" + "net" "net/http" "net/url" "github.com/mediocregopher/blog.mediocregopher.com/srv/http/apiutil" ) -func (a *api) checkCSRFMiddleware(h http.Handler) http.Handler { - return http.HandlerFunc(func(rw http.ResponseWriter, r *http.Request) { +func checkCSRF(r *http.Request, publicURL *url.URL) error { - refererURL, err := url.Parse(r.Referer()) - if err != nil { - apiutil.BadRequest(rw, r, errors.New("invalid Referer")) - return + if ipStr, _, err := net.SplitHostPort(r.Host); err == nil { + if ip := net.ParseIP(ipStr); ip != nil && ip.IsLoopback() { + return nil } + } + + refererURL, err := url.Parse(r.Referer()) + if err != nil { + return errors.New("invalid Referer") + } + + if refererURL.Scheme != publicURL.Scheme || + refererURL.Host != publicURL.Host { + return errors.New("invalid Referer") + } + + return nil +} + +func (a *api) checkCSRFMiddleware(h http.Handler) http.Handler { + return http.HandlerFunc(func(rw http.ResponseWriter, r *http.Request) { - if refererURL.Scheme != a.params.PublicURL.Scheme || - refererURL.Host != a.params.PublicURL.Host { + if err := checkCSRF(r, a.params.PublicURL); err != nil { apiutil.BadRequest(rw, r, errors.New("invalid Referer")) return } |