From 86edfaa883b98c6a701e9794f9d7b56679baecfc Mon Sep 17 00:00:00 2001 From: Thanatat Tamtan Date: Sun, 19 Jul 2026 20:32:26 +0700 Subject: [PATCH 1/2] docs: modernize CSRF guidance for SameSite era Explicit SameSite=Lax/Strict on the session cookie plus no-mutations- on-GET stops classic cross-site form CSRF in modern browsers; recommend a Sec-Fetch-Site check as defense-in-depth (subdomains are same-site) and demote token middleware to an if-you-use-it-anyway note. --- README.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/README.md b/README.md index 5fa5363..66a9681 100644 --- a/README.md +++ b/README.md @@ -64,7 +64,7 @@ Notes: ``` -- CSRF: hime ships no CSRF middleware — wire your token with `hx-headers`, e.g. ``. Use per-session (not per-request) tokens, or set `hx-history="false"`, since htmx snapshots pages into localStorage. +- CSRF: set `SameSite=Lax` (or `Strict`) explicitly on your session cookie and never mutate state on GET — that alone stops classic cross-site form CSRF in modern browsers. For defense-in-depth (untrusted subdomains are still "same-site"), reject mutating requests whose `Sec-Fetch-Site` header is cross-origin — a few lines of your own middleware; hime ships none. If you use token middleware anyway, wire it with `hx-headers`, e.g. ``, and prefer per-session tokens (or set `hx-history="false"`) since htmx snapshots pages into localStorage. ## License From e19ab88ebcdd0d456732718214de2a6c98856605 Mon Sep 17 00:00:00 2001 From: Thanatat Tamtan Date: Sun, 19 Jul 2026 20:35:40 +0700 Subject: [PATCH 2/2] docs: point CSRF defense-in-depth at http.NewCrossOriginProtection MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Go 1.25 stdlib ships the Sec-Fetch-Site guard (with Origin fallback, trusted origins, and bypass patterns) — recommend wrapping the handler instead of hand-rolling middleware. --- README.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/README.md b/README.md index 66a9681..ab01643 100644 --- a/README.md +++ b/README.md @@ -64,7 +64,7 @@ Notes: ``` -- CSRF: set `SameSite=Lax` (or `Strict`) explicitly on your session cookie and never mutate state on GET — that alone stops classic cross-site form CSRF in modern browsers. For defense-in-depth (untrusted subdomains are still "same-site"), reject mutating requests whose `Sec-Fetch-Site` header is cross-origin — a few lines of your own middleware; hime ships none. If you use token middleware anyway, wire it with `hx-headers`, e.g. ``, and prefer per-session tokens (or set `hx-history="false"`) since htmx snapshots pages into localStorage. +- CSRF: set `SameSite=Lax` (or `Strict`) explicitly on your session cookie and never mutate state on GET — that alone stops classic cross-site form CSRF in modern browsers. For defense-in-depth (untrusted subdomains are still "same-site"), wrap your handler with the standard library's [`http.NewCrossOriginProtection`](https://pkg.go.dev/net/http#CrossOriginProtection): `app.Handler(cop.Handler(mux))` — hime adds nothing because it composes directly. If you use token middleware anyway, wire it with `hx-headers`, e.g. ``, and prefer per-session tokens (or set `hx-history="false"`) since htmx snapshots pages into localStorage. ## License