Merge pull request #1 from kalbhor/master

feat: new flag for non https support
zerodha · Sep 16, 2021 · 10d49b8 · 10d49b8
2 parents 9276fac + eabbb6b
commit 10d49b8
Show file tree

Hide file tree

Showing 2 changed files with 4 additions and 2 deletions.
diff --git a/config.go b/config.go
@@ -14,4 +14,6 @@ type Config struct {
 	Path string
 	// cookie domain
 	Domain string
+	// set this true for non https
+	Unsecure bool
 }
diff --git a/csrf.go b/csrf.go
@@ -70,7 +70,7 @@ func (c *CSRF) Inject(handler fastglue.FastRequestHandler) fastglue.FastRequestH
 			Value:    value,
 			MaxAge:   c.cfg.MaxAge,
 			Path:     c.cfg.Path,
-			Secure:   true,
+			Secure:   !c.cfg.Unsecure,
 			HttpOnly: true,
 			SameSite: http.SameSite(c.cfg.SameSite),
 			Domain:   c.cfg.Domain,
@@ -152,7 +152,7 @@ func (c *CSRF) deny(r *fastglue.Request) {
 		Value:    "",
 		Expires:  fasthttp.CookieExpireDelete,
 		Path:     "/",
-		Secure:   true,
+		Secure:   !c.cfg.Unsecure,
 		HttpOnly: true,
 	}, r)