How to do csrf protection for http.Get requests?
qibobo opened this issue · comments
Currently the csrf protection will skip http Get requests in the code "if !contains(safeMethods, r.Method)".
In my application I want to some http Get requests to be protected, how to do it?
@elithrar
There are some routes in the application:
/index http.Get
/getSomething http.Get
/putSomething http.Put
The "/index" route will return a web page that contains the csrf-token and users can request the "/getSomething" by csrf attack as no csrf protection for it, right? I want to protect the "/getSomething".
I just want to skip some certain paths and protect all the other requests no matter they are http.get or not.