set csrf cookie policy

bueti · Nov 12, 2023 · fe0ef0b · fe0ef0b
1 parent 889cb16
commit fe0ef0b
Showing 1 changed file with 4 additions and 1 deletion.
diff --git a/cmd/api/router.go b/cmd/api/router.go
@@ -25,7 +25,10 @@ func (app *application) registerMiddleware() {
 	app.echo.Use(middleware.Gzip())
 	app.echo.Use(middleware.CORS())
 	app.echo.Use(middleware.CSRFWithConfig(middleware.CSRFConfig{
-		TokenLookup: "form:csrf_token",
+		TokenLookup:    "form:csrf_token",
+		CookieSecure:   true,
+		CookieHTTPOnly: true,
+		CookieSameSite: http.SameSiteStrictMode,
 	}))
 	app.echo.Use(middleware.Secure())
 	app.echo.Use(middleware.BodyLimit("1M"))