usememos/memos
1
1
Fork 0
mirror of https://github.com/usememos/memos.git synced 2025-01-01 01:51:46 +08:00
Code Issues Projects Releases Packages Wiki Activity

chore: fix CSRF (#876)

Browse source
This commit is contained in:
boojack 2022-12-30 00:17:19 +08:00 committed by GitHub
parent 64e5c343c5
commit c9bb2b785d
No known key found for this signature in database
GPG key ID: 4AEE18F83AFDEB23
2 changed files with 5 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

1
server/acl.go
View file

@ -27,6 +27,7 @@ func setUserSession(ctx echo.Context, user *api.User) error {
Path: "/", Path: "/",
MaxAge: 3600 * 24 * 30, MaxAge: 3600 * 24 * 30,
HttpOnly: true, HttpOnly: true,
SameSite: http.SameSiteStrictMode,
} }
sess.Values[userIDContextKey] = user.ID sess.Values[userIDContextKey] = user.ID
err := sess.Save(ctx.Request(), ctx.Response()) err := sess.Save(ctx.Request(), ctx.Response())

4
server/server.go
View file

@ -36,6 +36,10 @@ func NewServer(profile *profile.Profile) *Server {
`"status":${status},"error":"${error}"}` + "\n", `"status":${status},"error":"${error}"}` + "\n",
})) }))
e.Use(middleware.CSRFWithConfig(middleware.CSRFConfig{
TokenLookup: "cookie:_csrf",
}))
e.Use(middleware.CORS()) e.Use(middleware.CORS())
e.Use(middleware.TimeoutWithConfig(middleware.TimeoutConfig{ e.Use(middleware.TimeoutWithConfig(middleware.TimeoutConfig{