diff options
| -rw-r--r-- | cmd/server/main.go | 11 |
1 files changed, 10 insertions, 1 deletions
diff --git a/cmd/server/main.go b/cmd/server/main.go index 4f0d30f..b89362b 100644 --- a/cmd/server/main.go +++ b/cmd/server/main.go @@ -186,10 +186,19 @@ func main() { // In production, you should set csrf.Secure(true). // You can use an environment variable to control this setting. csrfOptions := []csrf.Option{ - csrf.Secure(true), // Set to true in production + csrf.Secure(os.Getenv("ENV") == "production"), csrf.Path("/"), } + sameSiteMode := csrf.SameSiteLaxMode + switch strings.ToLower(os.Getenv("CSRF_SAME_SITE")) { + case "strict": + sameSiteMode = csrf.SameSiteStrictMode + case "none": + sameSiteMode = csrf.SameSiteNoneMode + } + csrfOptions = append(csrfOptions, csrf.SameSite(sameSiteMode)) + trustedOrigins := os.Getenv("CSRF_TRUSTED_ORIGINS") if trustedOrigins != "" { origins := strings.Split(trustedOrigins, ",") |