{"id":13412892,"url":"https://github.com/justinas/nosurf","last_synced_at":"2026-10-19T11:46:54.166Z","repository":{"id":10208923,"uuid":"12303687","full_name":"justinas/nosurf","owner":"justinas","description":"CSRF protection middleware for Go.","archived":false,"fork":false,"pushed_at":"2025-05-13T12:23:43.000Z","size":95,"stargazers_count":1754,"open_issues_count":17,"forks_count":131,"subscribers_count":36,"default_branch":"master","last_synced_at":"2026-10-17T05:22:21.915Z","etag":null,"topics":["csrf","go","middleware","security"],"latest_commit_sha":null,"homepage":"http://godoc.org/github.com/justinas/nosurf","language":"Go","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"mit","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/justinas.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null}},"created_at":"2013-08-22T17:47:34.000Z","updated_at":"2026-10-12T22:27:37.000Z","dependencies_parsed_at":"2024-05-05T03:30:26.788Z","dependency_job_id":"c4d077e9-e801-42fb-8fa4-abcab8be8f31","html_url":"https://github.com/justinas/nosurf","commit_stats":{"total_commits":119,"total_committers":17,"mean_commits":7.0,"dds":"0.18487394957983194","last_synced_commit":"4d86df7a4affa1fa50ab39fb09aac56c3ce9c314"},"previous_names":[],"tags_count":3,"template":false,"template_full_name":null,"purl":"pkg:github/justinas/nosurf","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/justinas%2Fnosurf","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/justinas%2Fnosurf/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/justinas%2Fnosurf/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/justinas%2Fnosurf/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/justinas","download_url":"https://codeload.github.com/justinas/nosurf/tar.gz/refs/heads/master","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/justinas%2Fnosurf/sbom","scorecard":{"id":543849,"data":{"date":"2025-08-11","repo":{"name":"github.com/justinas/nosurf","commit":"ec9bb776d8e5ba9e906b6eb70428f4e7b009feee"},"scorecard":{"version":"v5.2.1-40-gf6ed084d","commit":"f6ed084d17c9236477efd66e5b258b9d4cc7b389"},"score":3.7,"checks":[{"name":"Dangerous-Workflow","score":10,"reason":"no dangerous workflow patterns detected","details":null,"documentation":{"short":"Determines if the project's GitHub Action workflows avoid dangerous patterns.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#dangerous-workflow"}},{"name":"Maintained","score":0,"reason":"0 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 0","details":null,"documentation":{"short":"Determines if the project is \"actively maintained\".","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#maintained"}},{"name":"Packaging","score":-1,"reason":"packaging workflow not detected","details":["Warn: no GitHub/GitLab publishing workflow detected."],"documentation":{"short":"Determines if the project is published as a package that others can easily download, install, easily update, and uninstall.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#packaging"}},{"name":"Code-Review","score":3,"reason":"Found 8/21 approved changesets -- score normalized to 3","details":null,"documentation":{"short":"Determines if the project requires human code review before pull requests (aka merge requests) are merged.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#code-review"}},{"name":"Binary-Artifacts","score":10,"reason":"no binaries found in the repo","details":null,"documentation":{"short":"Determines if the project has generated executable (binary) artifacts in the source repository.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#binary-artifacts"}},{"name":"Token-Permissions","score":0,"reason":"detected GitHub workflow tokens with excessive permissions","details":["Warn: no topLevel permission defined: .github/workflows/lint.yaml:1","Warn: no topLevel permission defined: .github/workflows/test.yaml:1","Info: no jobLevel write permissions found"],"documentation":{"short":"Determines if the project's workflows follow the principle of least privilege.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#token-permissions"}},{"name":"Pinned-Dependencies","score":0,"reason":"dependency not pinned by hash detected -- score normalized to 0","details":["Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/lint.yaml:13: update your workflow using https://app.stepsecurity.io/secureworkflow/justinas/nosurf/lint.yaml/master?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/lint.yaml:16: update your workflow using https://app.stepsecurity.io/secureworkflow/justinas/nosurf/lint.yaml/master?enable=pin","Warn: third-party GitHubAction not pinned by hash: .github/workflows/lint.yaml:21: update your workflow using https://app.stepsecurity.io/secureworkflow/justinas/nosurf/lint.yaml/master?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/test.yaml:13: update your workflow using https://app.stepsecurity.io/secureworkflow/justinas/nosurf/test.yaml/master?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/test.yaml:16: update your workflow using https://app.stepsecurity.io/secureworkflow/justinas/nosurf/test.yaml/master?enable=pin","Info:   0 out of   4 GitHub-owned GitHubAction dependencies pinned","Info:   0 out of   1 third-party GitHubAction dependencies pinned"],"documentation":{"short":"Determines if the project has declared and pinned the dependencies of its build process.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#pinned-dependencies"}},{"name":"CII-Best-Practices","score":0,"reason":"no effort to earn an OpenSSF best practices badge detected","details":null,"documentation":{"short":"Determines if the project has an OpenSSF (formerly CII) Best Practices Badge.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#cii-best-practices"}},{"name":"Security-Policy","score":0,"reason":"security policy file not detected","details":["Warn: no security policy file detected","Warn: no security file to analyze","Warn: no security file to analyze","Warn: no security file to analyze"],"documentation":{"short":"Determines if the project has published a security policy.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#security-policy"}},{"name":"Fuzzing","score":0,"reason":"project is not fuzzed","details":["Warn: no fuzzer integrations found"],"documentation":{"short":"Determines if the project uses fuzzing.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#fuzzing"}},{"name":"License","score":10,"reason":"license file detected","details":["Info: project has a license file: LICENSE:0","Info: FSF or OSI recognized license: MIT License: LICENSE:0"],"documentation":{"short":"Determines if the project has defined a license.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#license"}},{"name":"Signed-Releases","score":-1,"reason":"no releases found","details":null,"documentation":{"short":"Determines if the project cryptographically signs release artifacts.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#signed-releases"}},{"name":"Branch-Protection","score":0,"reason":"branch protection not enabled on development/release branches","details":["Warn: branch protection not enabled for branch 'master'"],"documentation":{"short":"Determines if the default and release branches are protected with GitHub's branch protection settings.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#branch-protection"}},{"name":"SAST","score":0,"reason":"SAST tool is not run on all commits -- score normalized to 0","details":["Warn: 0 commits out of 18 are checked with a SAST tool"],"documentation":{"short":"Determines if the project uses static code analysis.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#sast"}},{"name":"Vulnerabilities","score":10,"reason":"0 existing vulnerabilities detected","details":null,"documentation":{"short":"Determines if the project has open, known unfixed vulnerabilities.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#vulnerabilities"}}]},"last_synced_at":"2025-08-20T08:55:08.959Z","repository_id":10208923,"created_at":"2025-08-20T08:55:08.959Z","updated_at":"2025-08-20T08:55:08.959Z"},"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":344872684,"owners_count":38356427,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2026-10-03T21:59:58.778Z","status":"online","status_checked_at":"2026-10-19T02:00:06.414Z","response_time":53,"last_error":null,"robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":true,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["csrf","go","middleware","security"],"created_at":"2024-07-30T20:01:30.706Z","updated_at":"2026-10-19T11:46:53.683Z","avatar_url":"https://github.com/justinas.png","language":"Go","funding_links":[],"categories":["Forms","\u003ca id=\"79499aeece9a2a9f64af6f61ee18cbea\"\u003e\u003c/a\u003e浏览嗅探\u0026\u0026流量拦截\u0026\u0026流量分析\u0026\u0026中间人","Web Framework Hardening","\u003ca id=\"42f9e068b6511bcbb47d6b2b273097da\"\u003e\u003c/a\u003e未分类","表单","Go","\u003cspan id=\"表单-forms\"\u003e表单 Forms\u003c/span\u003e","Relational Databases","表单`表单解析与绑定`","表單","Repositories"],"sub_categories":["Advanced Console UIs","\u003ca id=\"11c73d3e2f71f3914a3bca35ba90de36\"\u003e\u003c/a\u003e中间人\u0026\u0026MITM","Search and Analytic Databases","\u003ca id=\"3bd67ee9f322e2c85854991c85ed6da0\"\u003e\u003c/a\u003e投毒\u0026\u0026Poisoning","高级控制台界面","\u003cspan id=\"高级控制台用户界面-advanced-console-uis\"\u003e高级控制台用户界面 Advanced Console UIs\u003c/span\u003e","检索及分析资料库","SQL 查询语句构建库","高級控制台界面","Middlewares"],"readme":"# nosurf\n\n[![Build Status](https://travis-ci.org/justinas/nosurf.svg?branch=master)](https://travis-ci.org/justinas/nosurf)\n[![GoDoc](http://godoc.org/github.com/justinas/nosurf?status.png)](http://godoc.org/github.com/justinas/nosurf)\n\n`nosurf` is an HTTP package for Go\nthat helps you prevent Cross-Site Request Forgery attacks.\nIt acts like a middleware and therefore \nis compatible with basically any Go HTTP application.\n\n### Why?\nEven though CSRF is a prominent vulnerability,\nGo's web-related package infrastructure mostly consists of\nmicro-frameworks that neither do implement CSRF checks,\nnor should they.\n\n`nosurf` solves this problem by providing a `CSRFHandler`\nthat wraps your `http.Handler` and checks for CSRF attacks\non every non-safe (non-GET/HEAD/OPTIONS/TRACE) method.\n\n`nosurf` requires Go 1.1 or later.\n\n### Features\n\n* Supports any `http.Handler` (frameworks, your own handlers, etc.)\nand acts like one itself.\n* Allows exempting specific endpoints from CSRF checks by\nan exact URL, a glob, or a regular expression.\n* Allows specifying your own failure handler. \nWant to present the hacker with an ASCII middle finger\ninstead of the plain old `HTTP 400`? No problem.\n* Uses masked tokens to mitigate the BREACH attack.\n* Has no dependencies outside the Go standard library.\n\n### Example\n```go\npackage main\n\nimport (\n\t\"fmt\"\n\t\"github.com/justinas/nosurf\"\n\t\"html/template\"\n\t\"net/http\"\n)\n\nvar templateString string = `\n\u003c!doctype html\u003e\n\u003chtml\u003e\n\u003cbody\u003e\n{{ if .name }}\n\u003cp\u003eYour name: {{ .name }}\u003c/p\u003e\n{{ end }}\n\u003cform action=\"/\" method=\"POST\"\u003e\n\u003cinput type=\"text\" name=\"name\"\u003e\n\n\u003c!-- Try removing this or changing its value\n     and see what happens --\u003e\n\u003cinput type=\"hidden\" name=\"csrf_token\" value=\"{{ .token }}\"\u003e\n\u003cinput type=\"submit\" value=\"Send\"\u003e\n\u003c/form\u003e\n\u003c/body\u003e\n\u003c/html\u003e\n`\nvar templ = template.Must(template.New(\"t1\").Parse(templateString))\n\nfunc myFunc(w http.ResponseWriter, r *http.Request) {\n\tcontext := make(map[string]string)\n\tcontext[\"token\"] = nosurf.Token(r)\n\tif r.Method == \"POST\" {\n\t\tcontext[\"name\"] = r.FormValue(\"name\")\n\t}\n\t\n\ttempl.Execute(w, context)\n}\n\nfunc main() {\n\tmyHandler := http.HandlerFunc(myFunc)\n\tfmt.Println(\"Listening on http://127.0.0.1:8000/\")\n\thttp.ListenAndServe(\":8000\", nosurf.New(myHandler))\n}\n```\n\n### Manual token verification\nIn some cases the CSRF token may be send through a non standard way,\ne.g. a body or request is a JSON encoded message with one of the fields\nbeing a token.\n\nIn such case the handler(path) should be excluded from an automatic\nverification by using one of the exemption methods:\n\n```go\n\tfunc (h *CSRFHandler) ExemptFunc(fn func(r *http.Request) bool)\n\tfunc (h *CSRFHandler) ExemptGlob(pattern string)\n\tfunc (h *CSRFHandler) ExemptGlobs(patterns ...string)\n\tfunc (h *CSRFHandler) ExemptPath(path string)\n\tfunc (h *CSRFHandler) ExemptPaths(paths ...string)\n\tfunc (h *CSRFHandler) ExemptRegexp(re interface{})\n\tfunc (h *CSRFHandler) ExemptRegexps(res ...interface{})\n```\n\nLater on, the token **must** be verified by manually getting the token from the cookie\nand providing the token sent in body through: `VerifyToken(tkn, tkn2 string) bool`.\n\nExample:\n```go\nfunc HandleJson(w http.ResponseWriter, r *http.Request) {\n\td := struct{\n\t\tX,Y int\n\t\tTkn string\n\t}{}\n\tjson.Unmarshal(ioutil.ReadAll(r.Body), \u0026d)\n\tif !nosurf.VerifyToken(nosurf.Token(r), d.Tkn) {\n\t\thttp.Errorf(w, \"CSRF token incorrect\", http.StatusBadRequest)\n\t\treturn\n\t}\n\t// do smth cool\n}\n```\n\n### Contributing\n\n0. Find an issue that bugs you / open a new one.\n1. Discuss.\n2. Branch off, commit, test.\n3. Make a pull request / attach the commits to the issue.\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fjustinas%2Fnosurf","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fjustinas%2Fnosurf","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fjustinas%2Fnosurf/lists"}