2022-05-20 17:17:31 +00:00
|
|
|
package http
|
2021-08-30 04:15:58 +00:00
|
|
|
|
|
|
|
import (
|
|
|
|
"errors"
|
2022-08-19 02:59:53 +00:00
|
|
|
"net"
|
2021-08-30 04:15:58 +00:00
|
|
|
"net/http"
|
2022-05-24 23:42:00 +00:00
|
|
|
"net/url"
|
2021-08-31 02:08:51 +00:00
|
|
|
|
2022-05-20 17:17:31 +00:00
|
|
|
"github.com/mediocregopher/blog.mediocregopher.com/srv/http/apiutil"
|
2021-08-30 04:15:58 +00:00
|
|
|
)
|
|
|
|
|
2022-08-19 02:59:53 +00:00
|
|
|
func checkCSRF(r *http.Request, publicURL *url.URL) error {
|
2021-08-30 04:15:58 +00:00
|
|
|
|
2022-08-19 02:59:53 +00:00
|
|
|
if ipStr, _, err := net.SplitHostPort(r.Host); err == nil {
|
|
|
|
if ip := net.ParseIP(ipStr); ip != nil && ip.IsLoopback() {
|
|
|
|
return nil
|
2021-09-02 23:02:20 +00:00
|
|
|
}
|
2022-08-19 02:59:53 +00:00
|
|
|
}
|
|
|
|
|
|
|
|
refererURL, err := url.Parse(r.Referer())
|
|
|
|
if err != nil {
|
|
|
|
return errors.New("invalid Referer")
|
|
|
|
}
|
|
|
|
|
|
|
|
if refererURL.Scheme != publicURL.Scheme ||
|
|
|
|
refererURL.Host != publicURL.Host {
|
|
|
|
return errors.New("invalid Referer")
|
|
|
|
}
|
|
|
|
|
|
|
|
return nil
|
|
|
|
}
|
|
|
|
|
|
|
|
func (a *api) checkCSRFMiddleware(h http.Handler) http.Handler {
|
|
|
|
return http.HandlerFunc(func(rw http.ResponseWriter, r *http.Request) {
|
2021-09-02 23:02:20 +00:00
|
|
|
|
2022-08-19 02:59:53 +00:00
|
|
|
if err := checkCSRF(r, a.params.PublicURL); err != nil {
|
2022-05-24 23:42:00 +00:00
|
|
|
apiutil.BadRequest(rw, r, errors.New("invalid Referer"))
|
2021-08-30 04:15:58 +00:00
|
|
|
return
|
|
|
|
}
|
|
|
|
|
|
|
|
h.ServeHTTP(rw, r)
|
|
|
|
})
|
|
|
|
}
|