aboutsummaryrefslogtreecommitdiff
path: root/src/net/http/csrf.go
AgeCommit message (Collapse)Author
2025-06-24net/http: reduce allocs in CrossOriginProtection.CheckJulien Cretel
Rather than repeatedly creating error values on CrossOriginProtection.Check's unhappy paths, return non-exported and effectively constant error variables. For #73626. Change-Id: Ibaa036c29417071b3601b8d200ab0902359d1bb9 GitHub-Last-Rev: e704d63cd63665845d544796e802134ea608e217 GitHub-Pull-Request: golang/go#74251 Reviewed-on: https://go-review.googlesource.com/c/go/+/681178 Reviewed-by: Sean Liao <sean@liao.dev> Reviewed-by: qiu laidongfeng2 <2645477756@qq.com> Reviewed-by: Junyang Shao <shaojunyang@google.com> LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com> Reviewed-by: Dmitri Shuralyov <dmitshur@google.com>
2025-06-10net/http: make the zero value of CrossOriginProtection workAustin Clements
Currently, CrossOriginProtection must be constructed by NewCrossOriginProtection. If you try to use the zero value, most methods will panic with a nil dereference. This CL makes CrossOriginProtection use on-demand initialization instead, so the zero value has the same semantics as the value currently returned by NewCrossOriginProtection. Now, NewCrossOriginProtection just constructs the zero value. We keep NewCrossOriginProtection by analogy to NewServeMux. Updates #73626 Fixes #74089. Change-Id: Ia80183eb6bfdafb0e002271c0b25c2d6230a159a Reviewed-on: https://go-review.googlesource.com/c/go/+/680396 Auto-Submit: Austin Clements <austin@google.com> LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com> Reviewed-by: Damien Neil <dneil@google.com>
2025-05-21net/http: add CrossOriginProtectionFilippo Valsorda
Fixes #73626 Change-Id: I6a6a4656862e7a38acb65c4815fb7a1e04896172 Reviewed-on: https://go-review.googlesource.com/c/go/+/674936 Reviewed-by: Damien Neil <dneil@google.com> Auto-Submit: Filippo Valsorda <filippo@golang.org> LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com> Reviewed-by: David Chase <drchase@google.com>