Resolve CSRF preventing POST/DELETE requests with CORS (#85)

temporalio · Jan 7, 2022 · 45970db · 45970db
1 parent 286083a
commit 45970db
Showing 1 changed file with 9 additions and 4 deletions.
diff --git a/server/server.go b/server/server.go
@@ -71,13 +71,18 @@ func NewServer(opts ...server_options.ServerOption) *Server {
 	// Middleware
 	e.Use(middleware.Logger())
 	e.Use(middleware.Recover())
-	e.Use(middleware.Secure())
-	e.Use(middleware.CSRF())
 	e.Use(middleware.CORSWithConfig(middleware.CORSConfig{
-		AllowOrigins:     serverOpts.Config.CORS.AllowOrigins,
-		AllowHeaders:     []string{echo.HeaderOrigin, echo.HeaderContentType, echo.HeaderAccept},
+		AllowOrigins: serverOpts.Config.CORS.AllowOrigins,
+		AllowHeaders: []string{
+			echo.HeaderOrigin, echo.HeaderContentType, echo.HeaderAccept,
+			echo.HeaderXCSRFToken,
+		},
 		AllowCredentials: true,
 	}))
+	e.Use(middleware.Secure())
+	e.Use(middleware.CSRFWithConfig(middleware.CSRFConfig{
+		CookiePath: "/",
+	}))
 	e.Use(session.Middleware(sessions.NewCookieStore(
 		securecookie.GenerateRandomKey(32),
 		securecookie.GenerateRandomKey(32),