如何用Golang防范Web安全威胁 讲解CSRF、XSS防护措施

package main

import (
    "crypto/rand"
    "encoding/base64"
    "fmt"
    "net/http"
    "time"

    "github.com/gorilla/sessions"
)

var store = sessions.NewCookieStore([]byte("something-very-secret"))

func generateCSRFToken() (string, error) {
    b := make([]byte, 32)
    _, err := rand.Read(b)
    if err != nil {
        return "", err
    }
    return base64.StdEncoding.EncodeToString(b), nil
}

func CSRFMiddleware(next http.Handler) http.Handler {
    return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
        session, _ := store.Get(r, "session-name")
        if session.IsNew {
            token, err := generateCSRFToken()
            if err != nil {
                http.Error(w, "Internal Server Error", http.StatusInternalServerError)
                return
            }
            session.Values["csrf_token"] = token
            err = session.Save(r, w)
            if err != nil {
                http.Error(w, "Internal Server Error", http.StatusInternalServerError)
                return
            }
        }

        if r.Method == http.MethodPost {
            token := r.FormValue("csrf_token")
            if token == "" {
                http.Error(w, "CSRF token missing", http.StatusBadRequest)
                return
            }

            sessionToken := session.Values["csrf_token"].(string)
            if token != sessionToken {
                http.Error(w, "Invalid CSRF token", http.StatusForbidden)
                return
            }

            // Regenerate token after successful POST request
            newToken, err := generateCSRFToken()
            if err != nil {
                http.Error(w, "Internal Server Error", http.StatusInternalServerError)
                return
            }
            session.Values["csrf_token"] = newToken
            err = session.Save(r, w)
            if err != nil {
                http.Error(w, "Internal Server Error", http.StatusInternalServerError)
                return
            }
        }

        next.ServeHTTP(w, r)
    })
}

func myHandler(w http.ResponseWriter, r *http.Request) {
    session, _ := store.Get(r, "session-name")
    csrfToken := session.Values["csrf_token"].(string)

    fmt.Fprintf(w, `
        <form method="POST">
            <input type="hidden" name="csrf_token" value="%s">
            <button type="submit">Submit</button>
        </form>
    `, csrfToken)
}

func main() {
    http.Handle("/", CSRFMiddleware(http.HandlerFunc(myHandler)))
    fmt.Println("Server listening on :8080")
    http.ListenAndServe(":8080", nil)
}

import (
    "html"
    "fmt"
)

func main() {
    userInput := "<script>alert('XSS')</script>"
    encodedInput := html.EscapeString(userInput)
    fmt.Println(encodedInput) // Output: <script>alert('XSS')</script>
}