Search code examples
securitybrowserwebcsrfcsrf-protection

does limiting the host in my mux prevent CSRF attacks?

If I have my mux router limited to accept requests only from my domain, then will that prevent a CSRF attack?

For example in my golang server I have all requests go through my baseRouter:

baseRouter := mux.NewRouter().Host(`{sub:.*}.myDomain.com`).Subrouter()

So wouldn't this mean that if a user was on another site some.attacker.net that posted a request off to my server, then it would simply get a 404 returned for every request because my server won't process any requests from other domains, thus preventing a CSRF attack, or am I basing this on some misconception?

Solution

  • No, because when attacker.example.com POSTs to mysite.example.org the host header will be set to mysite.example.org.

    Gorilla has a package to enable you to protect against Cross Site Request Forgery.