From 3eb04b1a2bdf9e53231fe862cfd76327371a9741 Mon Sep 17 00:00:00 2001 From: gramanas Date: Sat, 12 Sep 2026 11:24:17 +0300 Subject: Initial multi-tenant blog host Go + Postgres application serving a management dashboard on the base domain and one public blog per subdomain. Markdown posts organised in pages, form-based theme customisation, image uploads stored in Postgres, JWT cookie sessions with CSRF, superadmin user management, RSS feeds. Docker/compose deployment and a Makefile-driven dev environment with seed data. Co-Authored-By: Claude Opus 5 Claude-Session: https://claude.ai/code/session_01Sd8UPWrvyYCLj97JexNw3A --- internal/auth/csrf.go | 20 ++++++++++++++++++++ 1 file changed, 20 insertions(+) create mode 100644 internal/auth/csrf.go (limited to 'internal/auth/csrf.go') diff --git a/internal/auth/csrf.go b/internal/auth/csrf.go new file mode 100644 index 0000000..da34309 --- /dev/null +++ b/internal/auth/csrf.go @@ -0,0 +1,20 @@ +package auth + +import ( + "crypto/hmac" + "crypto/sha256" + "encoding/hex" + "fmt" +) + +// CSRFToken derives a per-user token from the secret; it changes whenever the +// user's token_version changes (password reset, disable) and needs no storage. +func CSRFToken(secret []byte, userID int64, tokenVersion int) string { + m := hmac.New(sha256.New, secret) + fmt.Fprintf(m, "csrf:%d:%d", userID, tokenVersion) + return hex.EncodeToString(m.Sum(nil)) +} + +func CheckCSRF(secret []byte, userID int64, tokenVersion int, got string) bool { + return hmac.Equal([]byte(CSRFToken(secret, userID, tokenVersion)), []byte(got)) +} -- cgit v1.2.3