added csrf

2026-01-21 13:41:15 +08:00
parent 7caf9b069d
commit 33c59d1c6d
2 changed files with 128 additions and 2 deletions
@@ -2,6 +2,7 @@ package routes

 import (
 	"authentication/handlers"
+	"authentication/middleware"
 	"database/sql"

 	"github.com/gorilla/mux"
@@ -16,9 +17,11 @@ func SetupRoutes(router *mux.Router, db *sql.DB) {
 	authRoutes := router.PathPrefix("/v1/auth").Subrouter()
 	authRoutes.HandleFunc("/login", handlers.GoogleLogin).Methods("GET")
 	authRoutes.HandleFunc("/callback", handlers.GoogleCallback).Methods("GET")
-	authRoutes.HandleFunc("/refresh_token", handlers.HandleTokenRefresh).Methods("GET", "POST", "OPTIONS")
-	authRoutes.HandleFunc("/logout", handlers.LogoutHandler).Methods("GET")
 	authRoutes.HandleFunc("/forgot-password", handlers.ForgotPassword).Methods("GET")
+	csrfProtected := authRoutes.NewRoute().Subrouter()
+	csrfProtected.Use(middleware.CSRFMiddleware)
+	csrfProtected.HandleFunc("/refresh_token", handlers.HandleTokenRefresh).Methods("POST", "OPTIONS")
+	csrfProtected.HandleFunc("/logout", handlers.LogoutHandler).Methods("POST")

 	// authRoutes.HandleFunc("/microsoft/login", handlers.MicrosoftLogin).Methods("GET")
 	// authRoutes.HandleFunc("/microsoft/callback", handlers.MicrosotCallback).Methods("GET")