b1dc8fcc4e
Add gorilla/csrf middleware to protect all HTML-serving routes against
cross-site request forgery attacks. The webhook endpoint is excluded
since it uses secret-based authentication.
Changes:
- Add gorilla/csrf v1.7.3 dependency
- Add CSRF() middleware method using session secret as key
- Apply CSRF middleware to all HTML route groups in routes.go
- Pass CSRF token to all templates via addGlobals helper
- Add {{ .CSRFField }} / {{ $.CSRFField }} hidden inputs to all forms
Closes #11
|
||
|---|---|---|
| .. | ||
| app_detail.html | ||
| app_edit.html | ||
| app_new.html | ||
| base.html | ||
| dashboard.html | ||
| deployments.html | ||
| login.html | ||
| setup.html | ||
| templates.go | ||