github.com/google/go-safeweb@v0.0.0-20231219055052-64d8cfc90fbb/safehttp/plugins/xsrf/xsrfblockall/xsrf.go (about)

     1  // Copyright 2022 Google LLC
     2  //
     3  // Licensed under the Apache License, Version 2.0 (the "License");
     4  // you may not use this file except in compliance with the License.
     5  // You may obtain a copy of the License at
     6  //
     7  //	https://www.apache.org/licenses/LICENSE-2.0
     8  //
     9  // Unless required by applicable law or agreed to in writing, software
    10  // distributed under the License is distributed on an "AS IS" BASIS,
    11  // WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
    12  // See the License for the specific language governing permissions and
    13  // limitations under the License.
    14  
    15  package xsrfblockall
    16  
    17  import (
    18  	"github.com/google/go-safeweb/safehttp"
    19  	"github.com/google/go-safeweb/safehttp/plugins/xsrf"
    20  	"log"
    21  )
    22  
    23  // Interceptor provides protection against Cross-Site Request Forgery attacks
    24  // by rejecting all state-changing request.
    25  type Interceptor struct{}
    26  
    27  var _ safehttp.Interceptor = &Interceptor{}
    28  
    29  // Before rejects every state-changing request (all except GET, HEAD, and OPTIONS).
    30  func (it *Interceptor) Before(w safehttp.ResponseWriter, r *safehttp.IncomingRequest, _ safehttp.InterceptorConfig) safehttp.Result {
    31  	if xsrf.StatePreserving(r) {
    32  		return safehttp.NotWritten()
    33  	}
    34  
    35  	if safehttp.IsLocalDev() {
    36  		log.Println("xsrfblockall plugin blocked a state changing request")
    37  	}
    38  
    39  	return w.WriteError(safehttp.StatusForbidden)
    40  }
    41  
    42  // Commit does nothing.
    43  func (it *Interceptor) Commit(w safehttp.ResponseHeadersWriter, r *safehttp.IncomingRequest, resp safehttp.Response, _ safehttp.InterceptorConfig) {
    44  }
    45  
    46  // Match returns false since there are no supported configurations.
    47  func (*Interceptor) Match(safehttp.InterceptorConfig) bool {
    48  	return false
    49  }