From eed10ce514f28e4acf772f76c92ca05eebec105f Mon Sep 17 00:00:00 2001
From: Brian Picciano <mediocregopher@gmail.com>
Date: Thu, 5 May 2022 21:20:22 -0600
Subject: Fix various problems with the srv build

---
 srv/src/api/csrf.go | 58 +++++++++++++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 58 insertions(+)
 create mode 100644 srv/src/api/csrf.go

(limited to 'srv/src/api/csrf.go')

diff --git a/srv/src/api/csrf.go b/srv/src/api/csrf.go
new file mode 100644
index 0000000..13b6ec6
--- /dev/null
+++ b/srv/src/api/csrf.go
@@ -0,0 +1,58 @@
+package api
+
+import (
+	"errors"
+	"net/http"
+
+	"github.com/mediocregopher/blog.mediocregopher.com/srv/api/apiutils"
+)
+
+const (
+	csrfTokenCookieName = "csrf_token"
+	csrfTokenHeaderName = "X-CSRF-Token"
+)
+
+func setCSRFMiddleware(h http.Handler) http.Handler {
+	return http.HandlerFunc(func(rw http.ResponseWriter, r *http.Request) {
+
+		csrfTok, err := apiutils.GetCookie(r, csrfTokenCookieName, "")
+
+		if err != nil {
+			apiutils.InternalServerError(rw, r, err)
+			return
+
+		} else if csrfTok == "" {
+			http.SetCookie(rw, &http.Cookie{
+				Name:   csrfTokenCookieName,
+				Value:  apiutils.RandStr(32),
+				Secure: true,
+			})
+		}
+
+		h.ServeHTTP(rw, r)
+	})
+}
+
+func checkCSRFMiddleware(h http.Handler) http.Handler {
+	return http.HandlerFunc(func(rw http.ResponseWriter, r *http.Request) {
+
+		csrfTok, err := apiutils.GetCookie(r, csrfTokenCookieName, "")
+
+		if err != nil {
+			apiutils.InternalServerError(rw, r, err)
+			return
+		}
+
+		givenCSRFTok := r.Header.Get(csrfTokenHeaderName)
+		if givenCSRFTok == "" {
+			givenCSRFTok = r.FormValue("csrfToken")
+		}
+
+		if csrfTok == "" || givenCSRFTok != csrfTok {
+			apiutils.BadRequest(rw, r, errors.New("invalid CSRF token"))
+			return
+		}
+
+		h.ServeHTTP(rw, r)
+	})
+}
-- 
cgit v1.2.3