Disabled CSRF (ARCH5125)

Key go.security.disabled-csrf · Severity warning · Category security · CWE CWE-352

csrf.UnsafeSkipCheck (gorilla/csrf) and nosurf.ExemptPath and friends switch CSRF validation off for a request or a path; csrf.Secure(false) sends the CSRF cookie over plain HTTP. Cookie-authenticated state-changing endpoints lose their protection.

Incorrect

func mw(next http.Handler) http.Handler {
  n := nosurf.New(next)
  n.ExemptPath("/api")
  return n
}

Correct

func mw(next http.Handler) http.Handler {
  return csrf.Protect(key, csrf.Secure(true))(next)
}

Fix

Keep CSRF protection on for every cookie-authenticated route; exempt only stateless token-authenticated endpoints, individually.