Victor_Jay
55c408d86c
- 安全：移除 CSP 中 esm.sh/cdnjs.cloudflare.com，highlight.js 主题已本地化 73 个文件 - 安全：StatusBanned 分支补 dummy hash 防时序攻击 - 安全：手写 constantTimeEq 替换为 crypto/subtle.ConstantTimeCompare - Bug：锁定操作消息已删除→已锁定 - YAGNI：删除 12 个空预留模板目录 - KISS：删除 common.CheckPassword 薄封装，统一用 bcrypt 调用 - KISS：删除 tokenCtrl 别名字段，api.go 统一用 authCtrl - RateLimiter：check()+recordFail 闭包模式重构为 try() 原子操作，消除竞态 - RateLimiter：新增 ClearIP() 方法，注册成功时清除 IP 计数 - 文档：修正 audit_service.go 注释编号跳跃(3→5→4) - 文档：修正 deps_core.go 过清理→过期清理
63 lines
1.5 KiB
Go
63 lines
1.5 KiB
Go
package middleware
|
||
|
||
import (
|
||
"crypto/subtle"
|
||
"log"
|
||
"net/http"
|
||
|
||
"metazone.cc/metalab/internal/config"
|
||
|
||
"github.com/gin-gonic/gin"
|
||
)
|
||
|
||
const (
|
||
csrfCookieName = "mlb_csrf"
|
||
csrfHeaderName = "X-CSRF-Token"
|
||
csrfMetaName = "csrf_token"
|
||
)
|
||
|
||
// CSRF 中间件：Double Submit Cookie 模式
|
||
func CSRF(cfg *config.Config) gin.HandlerFunc {
|
||
return func(c *gin.Context) {
|
||
if c.Request.Method == http.MethodGet ||
|
||
c.Request.Method == http.MethodHead ||
|
||
c.Request.Method == http.MethodOptions {
|
||
c.Next()
|
||
return
|
||
}
|
||
|
||
cookieToken, err := c.Cookie(csrfCookieName)
|
||
if err != nil || cookieToken == "" {
|
||
c.AbortWithStatusJSON(http.StatusForbidden, gin.H{
|
||
"success": false, "message": "CSRF 验证失败",
|
||
})
|
||
return
|
||
}
|
||
|
||
headerToken := c.GetHeader(csrfHeaderName)
|
||
if headerToken == "" {
|
||
headerToken = c.PostForm(csrfMetaName)
|
||
}
|
||
if headerToken == "" {
|
||
c.AbortWithStatusJSON(http.StatusForbidden, gin.H{
|
||
"success": false, "message": "CSRF 验证失败：缺少令牌",
|
||
})
|
||
return
|
||
}
|
||
|
||
if subtle.ConstantTimeCompare([]byte(cookieToken), []byte(headerToken)) != 1 {
|
||
log.Printf("[CSRF] MISMATCH | path=%s | cookie(len=%d)=%q | header(len=%d)=%q",
|
||
c.Request.URL.Path, len(cookieToken), cookieToken, len(headerToken), headerToken)
|
||
c.AbortWithStatusJSON(http.StatusForbidden, gin.H{
|
||
"success": false, "message": "CSRF 验证失败",
|
||
})
|
||
return
|
||
}
|
||
|
||
log.Printf("[CSRF] OK | path=%s | token(len=%d)=%q", c.Request.URL.Path, len(cookieToken), cookieToken)
|
||
|
||
c.Set(csrfMetaName, cookieToken)
|
||
c.Next()
|
||
}
|
||
}
|