From 1cb7a832f14676efe6f1bdf05d685e9afa651e99 Mon Sep 17 00:00:00 2001 From: Victor_Jay Date: Tue, 2 Jun 2026 16:32:20 +0800 Subject: [PATCH] =?UTF-8?q?fix:=20CSRF=20Token=20=E6=97=A5=E5=BF=97?= =?UTF-8?q?=E8=84=B1=E6=95=8F?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit - 移除 CSF 中间件日志中敏感 token 值的打印（移除 %q） - MISMATCH 日志仅保留路径和长度信息 - OK 日志移除，避免生产环境中泄露 CSRF token --- internal/middleware/csrf.go | 6 ++---- 1 file changed, 2 insertions(+), 4 deletions(-) diff --git a/internal/middleware/csrf.go b/internal/middleware/csrf.go index 92b870c..071570c 100644 --- a/internal/middleware/csrf.go +++ b/internal/middleware/csrf.go @@ -46,16 +46,14 @@ func CSRF(cfg *config.Config) gin.HandlerFunc { } if subtle.ConstantTimeCompare([]byte(cookieToken), []byte(headerToken)) != 1 { - log.Printf("[CSRF] MISMATCH | path=%s | cookie(len=%d)=%q | header(len=%d)=%q", - c.Request.URL.Path, len(cookieToken), cookieToken, len(headerToken), headerToken) + log.Printf("[CSRF] MISMATCH | path=%s | cookie_len=%d | header_len=%d", + c.Request.URL.Path, len(cookieToken), len(headerToken)) c.AbortWithStatusJSON(http.StatusForbidden, gin.H{ "success": false, "message": "CSRF 验证失败", }) return } - log.Printf("[CSRF] OK | path=%s | token(len=%d)=%q", c.Request.URL.Path, len(cookieToken), cookieToken) - c.Set(csrfMetaName, cookieToken) c.Next() }