389e1bc8b4
- auth.Mount(env, key) wraps csrf.Protect with locked D-14/D-24 options - auth.LoadKeyFromEnv() reads SESSION_SECRET, hex-decodes, validates 32 bytes; fails fast on error - ui.CSRFField(token) templ component renders hidden _csrf input - Layout, LoginPage/Fragment, SignupPage/Fragment, Index all embed @ui.CSRFField(csrfToken) - Handlers thread csrf.Token(r) into every page/fragment render call - NewRouter mounts auth.Mount after ResolveSession, before all route groups (D-24) - main.go calls auth.LoadKeyFromEnv(); logs.Fatalf on missing/invalid SESSION_SECRET - SESSION_SECRET documented in .env.example with openssl rand -hex 32 instruction - go.mod: gorilla/csrf v1.7.3 (direct); prior tests updated with getCSRFToken helper - All Plan 04/05/06 tests updated to acquire and submit valid _csrf tokens
9 lines
345 B
Text
9 lines
345 B
Text
package ui
|
|
|
|
// CSRFField renders the hidden CSRF token input required by gorilla/csrf.
|
|
// Every <form method="POST"> must include @ui.CSRFField(csrfToken) as its
|
|
// first child so that the middleware can validate the double-submit cookie
|
|
// (D-15, AUTH-06).
|
|
templ CSRFField(token string) {
|
|
<input type="hidden" name="_csrf" value={ token }/>
|
|
}
|