mediocregopher/mediocre-blog
1
0
Fork 0
Code Pull Requests Releases Activity

Don't check CSRF for manage and edit methods

Browse Source
This commit is contained in:
Brian Picciano 2022-11-29 22:20:34 +01:00
parent 16579fdf7f
commit 4878495914
1 changed files with 10 additions and 8 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

18
src/http/api.go
View File

@ -262,19 +262,21 @@ func (a *api) handler() http.Handler {
mux.Handle("/", a.blogHandler()) mux.Handle("/", a.blogHandler())
noCacheMiddleware := addResponseHeadersMiddleware(map[string]string{
"Cache-Control": "no-store, max-age=0",
"Pragma": "no-cache",
"Expires": "0",
})
h := applyMiddlewares( h := applyMiddlewares(
apiutil.MethodMux(map[string]http.Handler{ apiutil.MethodMux(map[string]http.Handler{
"GET": applyMiddlewares( "GET": applyMiddlewares(mux),
mux, "MANAGE": applyMiddlewares(mux, noCacheMiddleware),
), "EDIT": applyMiddlewares(mux, noCacheMiddleware),
"*": applyMiddlewares( "*": applyMiddlewares(
mux, mux,
a.checkCSRFMiddleware, a.checkCSRFMiddleware,
addResponseHeadersMiddleware(map[string]string{ noCacheMiddleware,
"Cache-Control": "no-store, max-age=0",
"Pragma": "no-cache",
"Expires": "0",
}),
), ),
}), }),
setLoggerMiddleware(a.params.Logger), setLoggerMiddleware(a.params.Logger),