CRSF with Sec-Fetch-Site checks

[aldas]

From: #2855

Note to self: Hackernews had this blog post posted.

• https://blog.miguelgrinberg.com/post/csrf-protection-without-tokens-or-hidden-form-fields
• https://words.filippo.io/csrf/
• Use a modern approach for cross-site request forgery protection rails/rails#56350

see https://github.com/golang/go/blob/master/src/net/http/csrf.go which was introduced in GO 1.25

[codecov]

Codecov Report

❌ Patch coverage is 90.19608% with 5 lines in your changes missing coverage. Please review.
✅ Project coverage is 93.51%. Comparing base (f24aaff) to head (d0b9f86).
⚠️ Report is 40 commits behind head on master.

Files with missing lines	Patch %	Lines
middleware/middleware.go	60.00%	1 Missing and 1 partial ⚠️
middleware/util.go	85.71%	1 Missing and 1 partial ⚠️
middleware/csrf.go	96.87%	1 Missing ⚠️

Additional details and impacted files

@@            Coverage Diff             @@
##           master    #2858      +/-   ##
==========================================
+ Coverage   93.25%   93.51%   +0.26%     
==========================================
  Files          39       42       +3     
  Lines        4652     4287     -365     
==========================================
- Hits         4338     4009     -329     
+ Misses        218      159      -59     
- Partials       96      119      +23     

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[aldas]

NB: in v4 we fall back to legacy token when Sec-Fetch-Site = same-site. In v5 same-site will be blocked as default behavior.

blocking same-site would be probably breaking change for applications that deal with requests from sub-domains.

	e.Use(middleware.CSRFWithConfig(middleware.CSRFConfig{
		TrustedOrigins: []string{"https://example.com", "https://subdomain.example.com"},
		
		// or custom check when request is state-changing and Sec-Fetch-Site is `cross-site` or `same-site`
		AllowSecFetchSiteFunc: func(c echo.Context) (bool, error) {
			return false, echo.NewHTTPError(http.StatusForbidden, "request blocked by CSRF")
			// return true, nil  // allows CSRF request through
			// return false, nil // falls back to legacy token logic
		},
	}))