Stowage/go
2
0
Fork 0
mirror of https://github.com/golang/go.git synced 2025-12-08 06:10:04 +00:00
Code Issues Projects Releases Packages Wiki Activity

net/http: reduce allocs in CrossOriginProtection.Check

Browse source 
Rather than repeatedly creating error values on
CrossOriginProtection.Check's unhappy paths, return non-exported and
effectively constant error variables.

For #73626.

Change-Id: Ibaa036c29417071b3601b8d200ab0902359d1bb9
GitHub-Last-Rev: e704d63cd6
GitHub-Pull-Request: golang/go#74251
Reviewed-on: https://go-review.googlesource.com/c/go/+/681178
Reviewed-by: Sean Liao <sean@liao.dev>
Reviewed-by: qiu laidongfeng2 <2645477756@qq.com>
Reviewed-by: Junyang Shao <shaojunyang@google.com>
LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com>
Reviewed-by: Dmitri Shuralyov <dmitshur@google.com>
This commit is contained in:
Julien Cretel 2025-06-23 16:19:19 +00:00 • committed by Sean Liao
parent 11f11f2a00
commit fcb9850859
1 changed files with 8 additions and 3 deletions
Download patch file Download diff file Expand all files Collapse all files

11
src/net/http/csrf.go
View file

@ -136,7 +136,7 @@ func (c *CrossOriginProtection) Check(req *Request) error {
if c.isRequestExempt(req) { if c.isRequestExempt(req) {
return nil return nil
} }
return errors.New("cross-origin request detected from Sec-Fetch-Site header") return errCrossOriginRequest
} }
origin := req.Header.Get("Origin") origin := req.Header.Get("Origin")
@ -159,10 +159,15 @@ func (c *CrossOriginProtection) Check(req *Request) error {
if c.isRequestExempt(req) { if c.isRequestExempt(req) {
return nil return nil
} }
return errors.New("cross-origin request detected, and/or browser is out of date: " + return errCrossOriginRequestFromOldBrowser
"Sec-Fetch-Site is missing, and Origin does not match Host")
} }
var (
errCrossOriginRequest = errors.New("cross-origin request detected from Sec-Fetch-Site header")
errCrossOriginRequestFromOldBrowser = errors.New("cross-origin request detected, and/or browser is out of date: " +
"Sec-Fetch-Site is missing, and Origin does not match Host")
)
// isRequestExempt checks the bypasses which require taking a lock, and should // isRequestExempt checks the bypasses which require taking a lock, and should
// be deferred until the last moment. // be deferred until the last moment.
func (c *CrossOriginProtection) isRequestExempt(req *Request) bool { func (c *CrossOriginProtection) isRequestExempt(req *Request) bool {