csrf middleware

[komuw]

• https://sourcegraph.com/github.com/django/[email protected]/-/blob/django/middleware/csrf.py?L161
• https://github.com/gofiber/fiber/tree/43aa457b979ec833cdd0098dc47c9964788dd19c/middleware/csrf
• https://github.com/gorilla/csrf

[komuw]

remember to set vary header:

• https://sourcegraph.com/github.com/django/[email protected]/-/blob/django/middleware/csrf.py?L258
• https://github.com/gofiber/fiber/blob/43aa457b979ec833cdd0098dc47c9964788dd19c/middleware/csrf/csrf.go#L88-L91

[komuw]

looks like it is okay to use HttpOnly with a csrf cookie:

• https://sourcegraph.com/github.com/django/[email protected]/-/blob/django/middleware/csrf.py?L254
• https://github.com/gofiber/fiber/blob/43aa457b979ec833cdd0098dc47c9964788dd19c/middleware/csrf/csrf.go#L81