Go Web 应用中 CSRF 防护的实现与最佳实践

import (
    "github.com/gorilla/sessions" // 假设使用gorilla/sessions管理会话
    "github.com/nu7hatch/gouuid"
    "golang.org/x/net/xsrftoken" // xsrftoken 库
)

var (
    // 定义一个会话存储，例如使用CookieStore
    store = sessions.NewCookieStore([]byte("super-secret-key"))
    // CSRF 密钥，应是一个足够长的随机字符串，并且在应用生命周期内保持不变
    csrfKey = "your-csrf-secret-key-that-is-long-and-random" 
)

func generateCSRFToken(w http.ResponseWriter, r *http.Request) (string, error) {
    session, err := store.Get(r, "session-name")
    if err != nil {
        // 处理会话获取错误
        return "", fmt.Errorf("failed to get session: %w", err)
    }

    // 确保会话中有一个唯一的ID
    if session.Values["id"] == nil || session.Values["id"].(string) == "" {
        newUUID, err := uuid.NewV4()
        if err != nil {
            return "", fmt.Errorf("failed to generate UUID: %w", err)
        }
        session.Values["id"] = newUUID.String()
    }

    userID := session.Values["id"].(string)
    // 根据用户ID和目标路径生成CSRF令牌
    // 这里的"/listing/new/post"是表单提交的目标路径
    csrfToken := xsrftoken.Generate(csrfKey, userID, "/listing/new/post")

    // 将令牌存储在会话中，以便后续验证
    session.Values["csrfToken"] = csrfToken

    // 保存会话
    if err := session.Save(r, w); err != nil {
        return "", fmt.Errorf("failed to save session: %w", err)
    }
    return csrfToken, nil
}

<form action="/listing/new/post" method="POST">
    <!-- 其他表单字段 -->
    <input type="hidden" name="csrfToken" value="{{ .CSRFToken }}">
    <button type="submit">提交</button>
</form>

func renderForm(w http.ResponseWriter, r *http.Request) {
    token, err := generateCSRFToken(w, r)
    if err != nil {
        http.Error(w, "Failed to generate CSRF token", http.StatusInternalServerError)
        return
    }

    data := struct {
        CSRFToken string
    }{
        CSRFToken: token,
    }

    tmpl.ExecuteTemplate(w, "form.html", data) // tmpl 是预加载的 HTML 模板
}

func handleFormSubmission(w http.ResponseWriter, r *http.Request) {
    session, err := store.Get(r, "session-name")
    if err != nil {
        http.Error(w, "Failed to get session", http.StatusInternalServerError)
        return
    }

    // 从会话中获取用户ID和存储的CSRF令牌
    userID, ok := session.Values["id"].(string)
    if !ok || userID == "" {
        http.Error(w, "Invalid session ID", http.StatusBadRequest)
        return
    }
    storedCSRFToken, ok := session.Values["csrfToken"].(string)
    if !ok || storedCSRFToken == "" {
        http.Error(w, "Missing CSRF token in session", http.StatusBadRequest)
        return
    }

    // 从表单中获取提交的CSRF令牌
    submittedCSRFToken := r.PostFormValue("csrfToken")

    // 1. 比较会话中的令牌和提交的令牌是否一致
    if storedCSRFToken != submittedCSRFToken {
        http.Error(w, "CSRF token mismatch", http.StatusForbidden)
        return
    }

    // 2. 使用 xsrftoken 包验证令牌的有效性（包括过期时间）
    // 这里的"/listing/new/post"必须与生成令牌时的目标路径一致
    if !xsrftoken.Valid(submittedCSRFToken, csrfKey, userID, "/listing/new/post") {
        http.Error(w, "Invalid or expired CSRF token", http.StatusForbidden)
        return
    }

    // CSRF 验证通过，继续处理表单数据
    // ...
    fmt.Fprintf(w, "Form submitted successfully!")
}