📒 docs: fix CSRF handler example #3412
Conversation
WalkthroughThe CSRF middleware documentation has been updated to reflect a simplified approach in the handler function. The new version directly retrieves the CSRF token from the context using a static key ( Changes
Sequence Diagram(s)sequenceDiagram
participant Client
participant CSRFHandler
participant Context
Client->>CSRFHandler: Send Request
CSRFHandler->>Context: Retrieve CSRF Token
alt Token is available
Context-->>CSRFHandler: Return token value
CSRFHandler-->>Client: Return CSRF form with token
else Token is absent
Context-->>CSRFHandler: Return empty token
CSRFHandler-->>Client: Return Internal Server Error
end
Poem
📜 Recent review detailsConfiguration used: CodeRabbit UI 📒 Files selected for processing (1)
🪧 TipsChatThere are 3 ways to chat with CodeRabbit:
Note: Be mindful of the bot's finite context window. It's strongly recommended to break down tasks such as reading entire modules into smaller chunks. For a focused discussion, use review comments to chat about specific files and their changes, instead of using the PR comments. CodeRabbit Commands (Invoked using PR comments)
Other keywords and placeholders
CodeRabbit Configuration File (
|
There was a problem hiding this comment.
Copilot reviewed 1 out of 1 changed files in this pull request and generated no comments.
Comments suppressed due to low confidence (2)
docs/middleware/csrf.md:53
- [nitpick] Consider returning an explicit error message in the response body (e.g., using SendString) to provide more context when the CSRF token is missing.
if token == "" {
docs/middleware/csrf.md:59
- [nitpick] Verify that the hardcoded formKey '_csrf' aligns with the intended middleware configuration. If dynamic retrieval is preferred, consider updating the code or documentation accordingly.
formKey := "_csrf"
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 0
🧹 Nitpick comments (1)
docs/middleware/csrf.md (1)
51-56: Simplified Token Retrieval and Error Handling:
In this updated example, the CSRF token is directly retrieved usingcsrf.TokenFromContext(c), and if it’s missing the handler now returns a 500 (Internal Server Error) instead of panicking. This streamlines the error handling process and avoids potential runtime panics caused by misconfigurations. One minor suggestion to consider is whether a 500 error best represents a missing token scenario, or if a 400-level status might better communicate a client error in some contexts.
📜 Review details
Configuration used: CodeRabbit UI
Review profile: CHILL
Plan: Pro
📒 Files selected for processing (1)
docs/middleware/csrf.md(1 hunks)
🔇 Additional comments (1)
docs/middleware/csrf.md (1)
57-61: Static Form Key and Documentation Clarity:
The change to use a fixed form key (formKey := "_csrf") along with the clarifying comments (lines 57–58) effectively simplifies the example. It clearly communicates that the static key should match the configuredKeyLookupin your middleware. This improves the readability of the configuration and helps reduce potential mismatches.
|
fixes #3387 (comment) |
gaby
changed the title
docs(middleware/csrf): fix handler example
Update the CSRF handler example to correctly retrieve the CSRF token and ensure proper error handling. Clarify the form key configuration in the comments.