Victor_Jay
97adf54d6d
## CI 修复 (P0/P1) P0 — 编译阻塞: - interfaces.go: postUseCase ISP 接口移除不用的 Create/Update/Delete P1 — 必须修复: - ST1000: 为 13 个包添加包注释 (common/config/model/service/...) - ST1005: redis_store.go 全部错误消息改为小写开头 - errcheck (19处): defer Close()→闭包忽略, notifier.Create→_=, r.Run→检查error - errorlint (9处): switch-on-error→errors.Is 链, ==→errors.Is - ST1020/ST1022: 导出符号注释以符号名开头 P2 — 安全评审: - gosec (12处): G203/G301/G304/G306 添加 nolint 注释并附理由 P3 — 清理: - unused: 移除 hasUnicode/energyStore/current/energyAdminUseCase - gofumpt + goimports 全量格式化 (35+ 文件)
43 lines
1.0 KiB
Go
43 lines
1.0 KiB
Go
package middleware
|
||
|
||
import (
|
||
"crypto/rand"
|
||
"encoding/hex"
|
||
"net/http"
|
||
|
||
"metazone.cc/mce/internal/config"
|
||
|
||
"github.com/gin-gonic/gin"
|
||
)
|
||
|
||
const csrfTokenLen = 32
|
||
|
||
// SetCSRFToken 在首次页面访问时下发 CSRF Cookie（由页面路由中间件调用）
|
||
func SetCSRFToken(c *gin.Context, cfg *config.Config) string {
|
||
secure := cfg.Server.Mode != "debug"
|
||
if existing, err := c.Cookie(csrfCookieName); err == nil && existing != "" {
|
||
c.Set(csrfMetaName, existing)
|
||
return existing
|
||
}
|
||
|
||
token, err := generateCSRFToken()
|
||
if err != nil {
|
||
token = "fallback-" + hex.EncodeToString([]byte("metazone"))
|
||
}
|
||
|
||
c.SetSameSite(http.SameSiteStrictMode)
|
||
maxAge := cfg.Session.RememberTimeout * 60
|
||
c.SetCookie(csrfCookieName, token, maxAge, "/", "", secure, false)
|
||
c.Set(csrfMetaName, token)
|
||
return token
|
||
}
|
||
|
||
// generateCSRFToken 生成 64 字符十六进制随机 CSRF token
|
||
func generateCSRFToken() (string, error) {
|
||
b := make([]byte, csrfTokenLen)
|
||
if _, err := rand.Read(b); err != nil {
|
||
return "", err
|
||
}
|
||
return hex.EncodeToString(b), nil
|
||
}
|