mediocregopher/mediocre-blog
1
0
Fork 0
Code Pull Requests Releases Activity

Don't check CSRF for manage and edit methods

Browse Source
This commit is contained in:
Brian Picciano 2022-11-29 22:20:34 +01:00
parent 16579fdf7f
commit 4878495914
1 changed files with 10 additions and 8 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

18
src/http/api.go
View File

@ -262,19 +262,21 @@ func (a *api) handler() http.Handler {
mux.Handle("/", a.blogHandler())
noCacheMiddleware := addResponseHeadersMiddleware(map[string]string{
"Cache-Control": "no-store, max-age=0",
"Pragma": "no-cache",
"Expires": "0",
})
h := applyMiddlewares(
apiutil.MethodMux(map[string]http.Handler{
"GET": applyMiddlewares(
mux,
),
"GET": applyMiddlewares(mux),
"MANAGE": applyMiddlewares(mux, noCacheMiddleware),
"EDIT": applyMiddlewares(mux, noCacheMiddleware),
"*": applyMiddlewares(
mux,
a.checkCSRFMiddleware,
addResponseHeadersMiddleware(map[string]string{
"Cache-Control": "no-store, max-age=0",
"Pragma": "no-cache",
"Expires": "0",
}),
noCacheMiddleware,
),
}),
setLoggerMiddleware(a.params.Logger),