Method checkSecFetchSiteRequest

middleware/csrf.go:260–307

(c *echo.Context)

var safeMethods = []string{http.MethodGet, http.MethodHead, http.MethodOptions, http.MethodTrace}

func (config CSRFConfig) checkSecFetchSiteRequest(c *echo.Context) (bool, error) {
	// https://cheatsheetseries.owasp.org/cheatsheets/Cross-Site_Request_Forgery_Prevention_Cheat_Sheet.html#fetch-metadata-headers
	// Sec-Fetch-Site values are:
	// - `same-origin` 	exact origin match - allow always
	// - `same-site` 		same registrable domain (subdomain and/or different port) - block, unless explicitly trusted
	// - `cross-site`		request originates from different site - block, unless explicitly trusted
	// - `none`					direct navigation (URL bar, bookmark) - allow always
	secFetchSite := c.Request().Header.Get(echo.HeaderSecFetchSite)
	if secFetchSite == "" {
		return false, nil
	}

	if len(config.TrustedOrigins) > 0 {
		// trusted sites ala OAuth callbacks etc. should be let through
		origin := c.Request().Header.Get(echo.HeaderOrigin)
		if origin != "" {
			for _, trustedOrigin := range config.TrustedOrigins {
				if strings.EqualFold(origin, trustedOrigin) {
					return true, nil
				}
			}
		}
	}
	isSafe := slices.Contains(safeMethods, c.Request().Method)
	if !isSafe { // for state-changing request check SecFetchSite value
		isSafe = secFetchSite == "same-origin" || secFetchSite == "none"
	}

	if isSafe {
		// This helps handlers that support older token-based CSRF protection.
		// We know that the client is using a browser that supports Sec-Fetch-Site header, so when the form is submitted in
		// the future with this dummy token value it is OK. Although the request is safe, the template rendered by the
		// handler may need this value to render CSRF token for form.
		c.Set(config.ContextKey, CSRFUsingSecFetchSite)
		return true, nil
	}
	// we are here when request is state-changing and `cross-site` or `same-site`

	// Note: if you want to allow `same-site` use config.TrustedOrigins or `config.AllowSecFetchSiteFunc`
	if config.AllowSecFetchSiteFunc != nil {
		return config.AllowSecFetchSiteFunc(c)
	}

	if secFetchSite == "same-site" {
		return false, echo.NewHTTPError(http.StatusForbidden, "same-site request blocked by CSRF")
	}
	return false, echo.NewHTTPError(http.StatusForbidden, "cross-site request blocked by CSRF")
}