From 15830af5b190cfb6f28e0bdf0f4bf110256ed9ef Mon Sep 17 00:00:00 2001
From: haturatu <taro@eyes4you.org>
Date: Mon, 13 Oct 2025 00:08:25 +0900
Subject: fix(csrf): js csrf support

---
 cmd/server/main.go | 43 +++++++++++++++++++++++++++++++------------
 1 file changed, 31 insertions(+), 12 deletions(-)

(limited to 'cmd/server')

diff --git a/cmd/server/main.go b/cmd/server/main.go
index 196164e..b60c1e0 100644
--- a/cmd/server/main.go
+++ b/cmd/server/main.go
@@ -15,6 +15,7 @@ import (
 	"time"
 
 	"github.com/joho/godotenv"
+	"github.com/gorilla/csrf"
 )
 
 func main() {
@@ -113,6 +114,7 @@ func main() {
 
 	// --- Protected API Endpoints (for Admin UI, protected by SessionAuth) ---
 	adminCreateUserAPI := http.HandlerFunc(handlers.CreateUserHandler)
+	getUsersHandler := http.HandlerFunc(handlers.GetUsersHandler)
 	adminUsersAPI := http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
 		if r.Method == http.MethodPost {
 			adminCreateUserAPI.ServeHTTP(w, r)
@@ -175,24 +177,41 @@ func main() {
 	}
 	listenAddr := ":" + port
 
-	// --- Start Server ---
-	logging.AppLog.Info("Server starting on " + listenAddr)
-
-		// Start periodic background tasks
-
-		go startBackgroundTasks(pool, rateLimiter)
-
-	
+	// --- CSRF Protection ---
+	csrfSecret := os.Getenv("CSRF_SECRET_KEY")
+	if csrfSecret == "" {
+		logging.AppLog.Error("CSRF_SECRET_KEY environment variable not set")
+		os.Exit(1)
+	}
+	// In production, you should set csrf.Secure(true).
+	// You can use an environment variable to control this setting.
+	csrfOptions := []csrf.Option{
+		csrf.Secure(true), // Set to true in production
+		csrf.Path("/"),
+	}
 
-		if err := http.ListenAndServe(listenAddr, finalHandler); err != nil {
+	trustedOrigins := os.Getenv("CSRF_TRUSTED_ORIGINS")
+	if trustedOrigins != "" {
+		origins := strings.Split(trustedOrigins, ",")
+		csrfOptions = append(csrfOptions, csrf.TrustedOrigins(origins))
+	}
 
-			logging.AppLog.Error("Server failed to start", "error", err)
+	csrfMiddleware := csrf.Protect(
+		[]byte(csrfSecret),
+		csrfOptions...,
+	)
 
-			os.Exit(1)
+	// --- Start Server ---
+	logging.AppLog.Info("Server starting on " + listenAddr)
 
-		}
+	// Start periodic background tasks
+	go startBackgroundTasks(pool, rateLimiter)
 
+	if err := http.ListenAndServe(listenAddr, csrfMiddleware(finalHandler)); err != nil {
+		logging.AppLog.Error("Server failed to start", "error", err)
+		os.Exit(1)
 	}
+}
 
 	
 
-- 
cgit v1.2.3