This package provides protection against Cross-Site Request Forgery (CSRF) attacks using modern browser Fetch metadata headers.

It requires no tokens or cookies, and works with all browsers since 2020.

package main

import (
    "net/http"
    "filippo.io/csrf"
)

func main() {
    mux := http.NewServeMux()
    mux.HandleFunc("/", func(w http.ResponseWriter, r *http.Request) {
        fmt.Fprintf(w, "Hello, world!")
    })

    protection := csrf.New()
    handler := protection.Handler(mux)
    
    http.ListenAndServe(":8080", handler)
}

For full API documentation, including bypass mechanisms, see pkg.go.dev.

For more information on this approach, see the standard library proposal.

The filippo.io/csrf/gorilla package provides a drop-in replacement for the github.com/gorilla/csrf package. It implements the same API, but uses the modern Fetch metadata headers instead of tokens and cookies.

Read the full package documentation for full migration details.

 import (
+    csrf "filippo.io/csrf/gorilla"
-    "github.com/gorilla/csrf"
 )