freefire
0c2b0d2d6a
后端 Go+Gin：认证/CSRF/限流、板块、帖子、评论、点赞、通知、用户资料、置顶推荐；前端 Next.js 16：发帖/编辑/删除、搜索、分页、点赞、通知中心、设置；基础设施 docker-compose 与配置模板；添加 .gitignore 与专有许可证（保留所有权利）
35 lines
944 B
Go
35 lines
944 B
Go
package middleware
|
|
|
|
import (
|
|
"net/http"
|
|
|
|
"github.com/freefire/jiang13-bbs/service"
|
|
"github.com/gin-gonic/gin"
|
|
)
|
|
|
|
// CSRFMiddleware CSRF 防护中间件
|
|
// 对 POST/PUT/DELETE 等状态变更请求，校验 X-CSRF-Token header 与 cookie 中的 CSRF token 是否一致
|
|
func CSRFMiddleware() gin.HandlerFunc {
|
|
return func(c *gin.Context) {
|
|
// 仅对状态变更方法校验
|
|
if c.Request.Method == http.MethodGet || c.Request.Method == http.MethodHead || c.Request.Method == http.MethodOptions {
|
|
c.Next()
|
|
return
|
|
}
|
|
|
|
cookieToken, err := c.Cookie(service.CSRFCookieName)
|
|
if err != nil || cookieToken == "" {
|
|
c.AbortWithStatusJSON(http.StatusForbidden, gin.H{"error": "CSRF token 缺失"})
|
|
return
|
|
}
|
|
|
|
headerToken := c.GetHeader(service.CSRFHeaderName)
|
|
if headerToken == "" || headerToken != cookieToken {
|
|
c.AbortWithStatusJSON(http.StatusForbidden, gin.H{"error": "CSRF 校验失败"})
|
|
return
|
|
}
|
|
|
|
c.Next()
|
|
}
|
|
}
|