389e1bc8b4
- auth.Mount(env, key) wraps csrf.Protect with locked D-14/D-24 options - auth.LoadKeyFromEnv() reads SESSION_SECRET, hex-decodes, validates 32 bytes; fails fast on error - ui.CSRFField(token) templ component renders hidden _csrf input - Layout, LoginPage/Fragment, SignupPage/Fragment, Index all embed @ui.CSRFField(csrfToken) - Handlers thread csrf.Token(r) into every page/fragment render call - NewRouter mounts auth.Mount after ResolveSession, before all route groups (D-24) - main.go calls auth.LoadKeyFromEnv(); logs.Fatalf on missing/invalid SESSION_SECRET - SESSION_SECRET documented in .env.example with openssl rand -hex 32 instruction - go.mod: gorilla/csrf v1.7.3 (direct); prior tests updated with getCSRFToken helper - All Plan 04/05/06 tests updated to acquire and submit valid _csrf tokens
27 lines
791 B
Modula-2
27 lines
791 B
Modula-2
module backend
|
|
|
|
go 1.26.1
|
|
|
|
require (
|
|
github.com/a-h/templ v0.3.1020
|
|
github.com/go-chi/chi/v5 v5.2.5
|
|
github.com/google/uuid v1.6.0
|
|
github.com/gorilla/csrf v1.7.3
|
|
github.com/jackc/pgx/v5 v5.9.2
|
|
github.com/pressly/goose/v3 v3.27.1
|
|
golang.org/x/crypto v0.51.0
|
|
golang.org/x/time v0.15.0
|
|
)
|
|
|
|
require (
|
|
github.com/gorilla/securecookie v1.1.2 // indirect
|
|
github.com/jackc/pgpassfile v1.0.0 // indirect
|
|
github.com/jackc/pgservicefile v0.0.0-20240606120523-5a60cdf6a761 // indirect
|
|
github.com/jackc/puddle/v2 v2.2.2 // indirect
|
|
github.com/mfridman/interpolate v0.0.2 // indirect
|
|
github.com/sethvargo/go-retry v0.3.0 // indirect
|
|
go.uber.org/multierr v1.11.0 // indirect
|
|
golang.org/x/sync v0.20.0 // indirect
|
|
golang.org/x/sys v0.44.0 // indirect
|
|
golang.org/x/text v0.37.0 // indirect
|
|
)
|