📢 This release of gorilla/csrf changes the default
SameSitecookie attribute to address changes in the SameSite spec (see golang/go#36990)
Previously : The
SameSiteDefaultModein csrf (prior to v1.7.0) would set
SameSiteon the cookie, which is not valid in some browsers, notably older versions of Chrome/Android. These browsers would not set cookies with this "invalid" attribute.
Now : The default mode is
SameSite=Lax, which is supported by Chrome v51, Firefox v60, Safari v13 and most recent browsers.
📚 If you're new to SameSite, read the MDN documentation for a great overview on why this attribute helps prevent cookies from being 'leaked' to third-party domains unintentionally.
🚀 🆕 This release introduces the
TrustedOriginsoption, which allows a user to explicitly trust specific Referers. This simplifies the use of this library when the backend domain (issuing the cookie) does not match the front-end domain, such as in Single Page Application architectures.
🚀 🐞 This release also fixes a regression to applying the default cookie MaxAge (cookies were only session cookies). This would typically have been unnoticed by most users as the CSRF middleware resets the cookie on each request.
- 🚀 We've removed support for versions of Go prior to v1.7 - v1.6 was released over 3.5 years ago (@kisielk making me feel old!)
- 🚚 As a result, we've also removed
gorilla/contextas a dependency, since Go 1.7+ has its own
- 🏗 Moved our CI to CircleCI - you can see the build dashboard here
🚚 38c9e46 Remove gorilla/context as part of pre-1.7 support (#114)
🏗 3719438 (elithrar/go-mod) [build] Add CircleCI config (#112)
📄 d162037 [docs] Improve JS header/form instructions (#103)
⚡️ 40703b8 Update and rename stale to stale.yml (#102)
🔀 1db7df7 Merge pull request #101 from gorilla/stalebot
📄 472e852 [docs] Add a "Reviewed by Hound" badge (#98)
abcfd25 (origin/stalebot) Add stalebot config
⚡️ f903b4e README.md: Update site URL
📄 10bfafc [docs] Note that developers should check the HTTP method (#91)
🔀 d690280 Merge pull request #88 from gorilla/elithrar/corporate-overlords
🚀 gorilla/csrf defines a
go.modfile and correctly defines a SemVer version (
v1.5.1) to support versioning in upcoming releases of Go.
👉 Uses the new request.Context from Go 1.7 for Go 1.7 automatically. Note that gorilla/context is incompatible with Go 1.7.
🛠 6958173 [doc] Fixed readme mux path prefix (#51)
✏️ 10e8fd1 [docs] Fix a few minor typos in examples. (#54)
📄 fdae182 docs: fix minor typo (#50)
📄 7f54448 [docs] Fix incorrect function name in docs (#49)
📄 bbe6687 [docs] Fix syntax typo (#48)
📄 0ff6a2c [docs] Improve commented code (#46)
📄 a8abe8a [docs] Mentions passing csrf.Secure(false) in local dev environments.
🛠 a9c30ae [bugfix] Remove dependency on gorilla/context for go1.7+ (#42)
🛠 4642ecf [bugfix] Support a cookie MaxAge of 0. (#39)
🔀 101aaa4 Merge branch 'master' of github.com:gorilla/csrf
2a06c32 [ci] Add 1.6; skip install block; don't simplify.
🚚 0bb4971 [deps] Move from errors -> github.com/pkg/errors
🚚 dd1bce8 [deps] Move from errors -> github.com/pkg/errors
- 📇 With Go 1.7's
net/httppackage growing support for context.Context as part of
http.Request, gorilla/csrf now uses the context to pass CSRF tokens and other metadata alongside the request instead of gorilla/context.
- NOTE: There is a minor breaking change with
UnsafeSkipCheck- it now returns a
*http.Request. Existing applications will "fail closed" (i.e. CSRF will be enforced again). Since this was a relatively new feature (less than a week old) the impact of this should be very minor.
- 📇 With Go 1.7's
🔒 v1.3 includes an important security fix for users of Go 1.2 (Debian <=7, Ubuntu <=14.10, etc.). This would cause token comparison to fail: https://groups.google.com/forum/#!topic/gorilla-web/G3aIFrm0LVI
- 🛠 [bugfix] Token comparison could fail on versions of Go < 1.3.
- ⚡️ [ci] Updated Travis to use matrix builds.
- [feature] Custom field names are now passed to TemplateField implicitly.
- 🏗 [feature] Expose an Option type for building functional options.
- ✅ [ci] Run go vet, gofmt and the race detector during tests
📚 Note that gorilla/csrf respects SemVer as defined at http://semver.org/ but will not make backward-incompatible changes unless a security fix requires it (which is extremely unlikely given the small API of the package!). "MINOR" versions as defined in SemVer will encapsulate additions to the API or resolving implicit behaviour, whereas "PATCH" versions will typically encapsulate documentation changes or clarifications.
v1.1October 19, 2015