# gorilla/csrf

Package gorilla/csrf provides Cross Site Request Forgery (CSRF) prevention middleware for Go web applications & services 🔒

Repository: https://github.com/gorilla/csrf
Canonical: https://ross.abutalabs.com/products/csrf
Homepage: https://gorilla.github.io
Language: Go
License: BSD-3-Clause
License Family: permissive
Topics: csrf-protection, gorilla, middleware, golang, security, csrf, xsrf, csrf-tokens, go, gorilla-web-toolkit
Last push: 2025-04-14T02:56:35+00:00

## Health v2 (maintenance only)
Score: 30/100 (v2, computed 2026-09-03T02:20:16.233290+00:00)
- activity 16, release rhythm 8, longevity 100
- inputs: {"age_days": 4049, "days_push": 506, "days_rel": 506, "gap_med": null, "n_releases_24m": 1}
- flags: none
- formula: round(0.45*activity + 0.35*rhythm + 0.20*longevity); archived -> min(score, 10)

## Adoption (not part of the score)
Stars 1209, forks 174 (observed 2026-08-28T04:03:59.834998+00:00)

## What it is
gorilla/csrf is a Go HTTP middleware library that provides cross-site request forgery (CSRF) protection for web applications and services. It works with any framework built on Go's http.Handler interface, including net/http, Gorilla, Gin, and Echo.

## Use cases
- protect go web forms from csrf attacks
- add csrf tokens to html forms in go
- secure json apis against cross-site request forgery
- add csrf middleware to gin or echo app
- generate hidden csrf input field in html/template
- prevent xsrf attacks in go http service

## When to choose
- you need battle-tested CSRF protection for a Go web app or API
- you use net/http or any http.Handler-compatible router and want drop-in middleware
- you want template helpers for embedding CSRF tokens in HTML forms

## When to avoid
- you are not writing a Go web application
- you need protection against other attack classes like XSS or SQL injection
- you want a full security suite rather than a single-purpose CSRF library

## Facets
- artifact type: library
- maturity: stable
- function: middleware, security, http-server
- domain: web-development, backend, security
- platform: go
- tags: csrf, csrf-protection, xsrf, gorilla-web-toolkit, http-middleware, web-server

## Member repositories
- gorilla/csrf (main) score 30

## Provenance
- Observed fields: from GitHub, fetched 2026-08-28T04:03:59.834998+00:00.
- Health v2: computed from the inputs above; adoption is never an input.
- Inferred fields (summary, facets, guidance): AI-extracted, prompt v1, taxonomy v1, on 2026-08-30T06:18:34.996074+00:00, confidence not recorded.
  - readme: https://github.com/gorilla/csrf (fetched 2026-08-28T04:03:59.834998+00:00, sha 7bb278c504f4)
  - homepage: https://gorilla.github.io (fetched 2026-08-29T12:26:15.350939+00:00, sha aa93940b2bb1)
- Data as of 2026-08-30T08:39:29.467469+00:00.