YourSelfHosted/memos
1
0
Fork 0
mirror of https://github.com/usememos/memos.git synced 2025-06-05 22:09:59 +02:00
Code Issues Packages Projects Releases Wiki Activity

chore: fix CSRF (#876)

Browse Source
This commit is contained in:
boojack
2022-12-30 00:17:19 +08:00
committed by GitHub
parent 64e5c343c5
commit c9bb2b785d
2 changed files with 5 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

1
server/acl.go
View File

@@ -27,6 +27,7 @@ func setUserSession(ctx echo.Context, user *api.User) error {
Path: "/", Path: "/",
MaxAge: 3600 * 24 * 30, MaxAge: 3600 * 24 * 30,
HttpOnly: true, HttpOnly: true,
SameSite: http.SameSiteStrictMode,
} }
sess.Values[userIDContextKey] = user.ID sess.Values[userIDContextKey] = user.ID
err := sess.Save(ctx.Request(), ctx.Response()) err := sess.Save(ctx.Request(), ctx.Response())

4
server/server.go
View File

@@ -36,6 +36,10 @@ func NewServer(profile *profile.Profile) *Server {
`"status":${status},"error":"${error}"}` + "\n", `"status":${status},"error":"${error}"}` + "\n",
})) }))
e.Use(middleware.CSRFWithConfig(middleware.CSRFConfig{
TokenLookup: "cookie:_csrf",
}))
e.Use(middleware.CORS()) e.Use(middleware.CORS())
e.Use(middleware.TimeoutWithConfig(middleware.TimeoutConfig{ e.Use(middleware.TimeoutWithConfig(middleware.TimeoutConfig{