Adopt Go 1.25 cross origin protections?

[yawn]

Replacement for the discussion in axum.

In a recent blogpost @FiloSottile discussed background research that went into a feature of the Go standard library: a modern CSRF protection middleware.

tower-http can be considered as one of the equivalents of (the server part) of net/http and might want to consider porting this feature. This boils down to (quoting from the blog):

1. Allow all GET, HEAD, or OPTIONS requests
2. If the Origin header matches an allow-list of trusted origins, allow the request
3. If the Sec-Fetch-Site header is present and the value is same-origin or none, allow the request, otherwise reject
4. If neither the Sec-Fetch-Site nor the Origin headers are present, allow the request
5. If the Origin header’s host (including the port) matches the Host header, allow the request, otherwise reject it

Seems simple enough to implement. Giving the thoroughness of the background research and subsequent inclusion of the solution into the Go standard this seems like a worthy addition to tower-http.

[seanmonstar]

It sounds interesting. My personal suggestion is to try to making it in a separate library, and test it out some. We could consider adding it after that, but it would help iteration without needing much from the limited time our maintainers have to pay attention to tower-http.

[yawn]

Makes sense. I still wanted to push since I agree with the author that such an inclusion makes a lot of sense for a standard library.

If there is no bandwidth the default would be another crate but that might suffer from the usual visibility issues.

[seanmonstar]

It could make sense to add after experimentation, for sure. :)

[yawn]

Only had some time today to commit a PoC here: https://github.com/yawn/tower-csrf

There is some test coverage but still a few items to consider, currently

• More test coverage and line-by-line comparison with the reference implementation
• Documentation (currently there is none)
• Change the order of the logic to match the reference implementation (or documentation) exactly

If you have 5m @seanmonstar, have a look please.