docs: note CSRF ContextKey removal #3706
Conversation
WalkthroughUpdates docs/whats_new.md to reflect CSRF middleware public API changes: field renames/removals, new Extractor, removal of FromCookie, new csrf.TokenFromContext and csrf.HandlerFromContext helpers, and clarified context-based access patterns with examples. Changes
Sequence Diagram(s)sequenceDiagram
autonumber
actor Client
participant App
participant CSRF as CSRF Middleware
participant Extractor
participant Ctx as Request Context
participant Handler as Downstream Handler
Client->>App: HTTP Request
App->>CSRF: Invoke middleware
CSRF->>Extractor: Extract token (header/form/query...)
Extractor-->>CSRF: Token or missing
CSRF->>Ctx: Store token and handler refs
alt token valid
CSRF->>Handler: Next()
note over Handler,Ctx: Handler can call<br/>csrf.TokenFromContext(c)<br/>csrf.HandlerFromContext(c)
Handler-->>App: Response
else token invalid
CSRF-->>App: CSRF error response
end
App-->>Client: HTTP Response
Estimated code review effort🎯 2 (Simple) | ⏱️ ~10 minutes Possibly related PRs
Suggested labels
Suggested reviewers
Poem
✨ Finishing Touches🧪 Generate unit tests
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. 🪧 TipsChatThere are 3 ways to chat with CodeRabbit:
SupportNeed help? Create a ticket on our support page for assistance with any issues or questions. CodeRabbit Commands (Invoked using PR/Issue comments)Type Other keywords and placeholders
CodeRabbit Configuration File (
|
There was a problem hiding this comment.
Pull Request Overview
This PR documents the removal of the ContextKey field from the CSRF middleware configuration and provides migration guidance for developers. The change improves security by using unexported keys and standardizes access patterns through helper functions.
Key Changes
- Documents the removal of the
ContextKeyfield from CSRF middleware - Adds migration instructions for accessing CSRF tokens and handlers via new helper functions
- Updates both the main changelog and migration guide sections
![gemini-code-assist[bot]](https://avatars.githubusercontent.com/in/956858?s=60&v=4){kind=small}
There was a problem hiding this comment.
Summary of Changes
Hello @ReneWerner87, I'm Gemini Code Assist1! I'm currently reviewing this pull request and will post my feedback shortly. In the meantime, here's a summary to help you and other reviewers quickly get up to speed!
This pull request focuses on updating the documentation to reflect a significant change in the CSRF middleware. Specifically, it addresses the removal of the ContextKey field, which previously allowed custom keys for storing CSRF-related data in the context. The primary goal is to inform users about this change and provide clear instructions on how to adapt their code to access CSRF tokens and handlers using the newly introduced helper functions, ensuring a smooth transition and continued functionality.
Highlights
- CSRF Middleware Documentation Update: The documentation for the CSRF middleware has been updated to reflect the removal of the
ContextKeyfield. This change means that CSRF tokens and handlers are now stored using unexported keys within the context. - Migration Steps for CSRF Access: New migration steps have been added to guide users on how to access CSRF tokens and handlers. Users should now use the helper functions
csrf.TokenFromContext(c)andcsrf.HandlerFromContext(c)to retrieve these values from the context.
Using Gemini Code Assist
The full guide for Gemini Code Assist can be found on our documentation page, here are some quick tips.
Invoking Gemini
You can request assistance from Gemini at any point in your pull request via creating an issue comment (i.e. comment on the pull request page) using either /gemini <command> or @gemini-code-assist <command>. Below is a summary of the supported commands.
| Feature | Command | Description |
|---|---|---|
| Code Review | /gemini review |
Performs a code review for the current pull request in its current state. |
| Pull Request Summary | /gemini summary |
Provides a summary of the current pull request in its current state. |
| Comment | @gemini-code-assist | Responds in comments when explicitly tagged, both in issue comments and review comments. |
| Help | /gemini help |
Displays a list of available commands. |
Customization
To customize Gemini Code Assist for GitHub experience, repository maintainers can create a configuration file and/or provide a custom code review style guide (such as PEP-8 for Python) by creating and adding files to a .gemini/ folder in the base of the repository. Detailed instructions can be found here.
Limitations & Feedback
Gemini Code Assist may make mistakes. Please leave feedback on any instances where its feedback is incorrect or counter productive. You can react with 👍 and 👎 on @gemini-code-assist comments. If you're interested in giving your feedback about your experience with Gemini Code Assist for Github and other Google products, sign up here.
You can also get AI-powered code generation, chat, as well as code reviews directly in the IDE at no cost with the Gemini Code Assist IDE Extension.
Footnotes
-
Review the Privacy Notices, Generative AI Prohibited Use Policy, Terms of Service, and learn how to configure Gemini Code Assist in GitHub here. Gemini can make mistakes, so double check it and use code with caution. ↩
There was a problem hiding this comment.
Summary of Changes
Hello @ReneWerner87, I'm Gemini Code Assist1! I'm currently reviewing this pull request and will post my feedback shortly. In the meantime, here's a summary to help you and other reviewers quickly get up to speed!
This pull request updates the documentation to reflect changes in the CSRF middleware. Specifically, it notes the removal of the ContextKey field and provides clear migration instructions for accessing CSRF tokens and handlers using new helper functions.
Highlights
- CSRF
ContextKeyRemoval Documentation: TheContextKeyfield has been removed from the CSRF middleware configuration, and this PR updates thewhats_new.mddocumentation to reflect this change. - Updated CSRF Token/Handler Access: Migration steps are added to guide users on how to retrieve CSRF tokens and handlers, which are now stored using unexported keys, via
csrf.TokenFromContext(c)andcsrf.HandlerFromContext(c).
Using Gemini Code Assist
The full guide for Gemini Code Assist can be found on our documentation page, here are some quick tips.
Invoking Gemini
You can request assistance from Gemini at any point in your pull request via creating an issue comment (i.e. comment on the pull request page) using either /gemini <command> or @gemini-code-assist <command>. Below is a summary of the supported commands.
| Feature | Command | Description |
|---|---|---|
| Code Review | /gemini review |
Performs a code review for the current pull request in its current state. |
| Pull Request Summary | /gemini summary |
Provides a summary of the current pull request in its current state. |
| Comment | @gemini-code-assist | Responds in comments when explicitly tagged, both in issue comments and review comments. |
| Help | /gemini help |
Displays a list of available commands. |
Customization
To customize Gemini Code Assist for GitHub experience, repository maintainers can create a configuration file and/or provide a custom code review style guide (such as PEP-8 for Python) by creating and adding files to a .gemini/ folder in the base of the repository. Detailed instructions can be found here.
Limitations & Feedback
Gemini Code Assist may make mistakes. Please leave feedback on any instances where its feedback is incorrect or counter productive. You can react with 👍 and 👎 on @gemini-code-assist comments. If you're interested in giving your feedback about your experience with Gemini Code Assist for Github and other Google products, sign up here.
You can also get AI-powered code generation, chat, as well as code reviews directly in the IDE at no cost with the Gemini Code Assist IDE Extension.
Footnotes
-
Review the Privacy Notices, Generative AI Prohibited Use Policy, Terms of Service, and learn how to configure Gemini Code Assist in GitHub here. Gemini can make mistakes, so double check it and use code with caution. ↩
There was a problem hiding this comment.
Code Review
This pull request updates the documentation to reflect the removal of the ContextKey field from the CSRF middleware. The changes in docs/whats_new.md correctly note this removal and point users to the new helper functions. I've added one suggestion to improve the migration guide's clarity and consistency by providing a 'Before' and 'After' code example, similar to other migration points in the same section.
| - **ContextKey Removal**: The `ContextKey` field has been removed from the CSRF middleware configuration. Access the token and handler using helper functions instead: | ||
|
|
||
| ```go | ||
| token := csrf.TokenFromContext(c) | ||
| handler := csrf.HandlerFromContext(c) | ||
| ``` |
There was a problem hiding this comment.
For consistency with other migration points in this section, consider providing a Before and After example. This would make it clearer to users what the new helper functions replace.
Here is a suggested replacement for lines 2112-2117:
- **ContextKey Removal**: The `ContextKey` field has been removed from the CSRF middleware configuration. Use the new helper functions to access the token and handler from the context instead of `c.Locals()`.
**Before:**
```go
// In a handler, assuming default ContextKey "csrf"
token := c.Locals("csrf")After:
// In a handler
token := csrf.TokenFromContext(c)
handler := csrf.HandlerFromContext(c)![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 0
🧹 Nitpick comments (2)
docs/whats_new.md (2)
1118-1119: CSRF: solid note on ContextKey removal; add a tiny example and cross-link for faster migrationNice, this clearly states the change and the new helpers. Consider adding a 5-line example and a short note about middleware ordering, plus a cross-link to the migration section below. This will reduce confusion when folks first hit this page.
The `ContextKey` field has been removed. Tokens and handlers are now stored using unexported keys; retrieve them with `csrf.TokenFromContext(c)` or `csrf.HandlerFromContext(c)`. +For example: + +```go +app.Get("/form", func(c fiber.Ctx) error { + token := csrf.TokenFromContext(c) + c.Set("X-CSRF-Token", token) // expose via header if needed + return c.Render("form", fiber.Map{"csrf_token": token}) +}) +``` + +Note: Ensure the CSRF middleware is registered and executed before using these helpers. See the detailed migration steps in the [CSRF migration](#csrf-1).
2112-2118: Add nil-check guard and example CSRF token exposureTo help users avoid nil pointer panics when the CSRF middleware isn’t applied and give them a copy-paste snippet for exposing the token, update the migration example in
docs/whats_new.md(lines 2112–2118):-```go -token := csrf.TokenFromContext(c) -handler := csrf.HandlerFromContext(c) -``` +```go +token := csrf.TokenFromContext(c) +// Typical usage: expose CSRF token to clients +c.Set("X-CSRF-Token", token) // e.g., HTTP header +// or pass to templates: fiber.Map{"csrf_token": token} + +// Safely retrieve the handler (nil if middleware not applied) +if h := csrf.HandlerFromContext(c); h != nil { + // perform handler-specific operations +} +```• Verified
TokenFromContext(c fiber.Ctx) stringandHandlerFromContext(c fiber.Ctx) *Handlerexist in themiddleware/csrfpackage, so the nil-guard is needed.
• This gives users a minimal, safe starting point for both token retrieval and handler usage.
📜 Review details
Configuration used: CodeRabbit UI
Review profile: CHILL
Plan: Pro
💡 Knowledge Base configuration:
- MCP integration is disabled by default for public repositories
- Jira integration is disabled by default for public repositories
- Linear integration is disabled by default for public repositories
You can enable these sources in your CodeRabbit configuration.
📒 Files selected for processing (1)
docs/whats_new.md(2 hunks)
🧰 Additional context used
📓 Path-based instructions (1)
docs/**
📄 CodeRabbit inference engine (.github/copilot-instructions.md)
Review and update the contents of the
docsfolder if necessary when modifying code
Files:
docs/whats_new.md
Summary
ContextKeyfrom CSRF middlewareTesting
make audit(fails: EncodeMsg passes lock by value)make generatemake betteralign(fails: package requires newer Go version go1.25)make modernize(fails: package requires newer Go version go1.25)make formatmake test(0 tests run)https://chatgpt.com/codex/tasks/task_e_68a9d1855f348326bd2f89899c69baee