justinas/nosurf

Health v2 · maintenance only

Adoption not part of the score

1747 stars · 129 forks observed · 2026-08-28

What it is AI-extracted, prompt v1, taxonomy v1, 2026-08-30, confidence not recorded

nosurf is a Go HTTP package that provides CSRF protection via a CSRFHandler middleware wrapping any http.Handler. It validates tokens on unsafe HTTP methods, supports endpoint exemptions, custom failure handlers, and masked tokens to mitigate BREACH attacks.

Use cases

• add csrf protection to a go http server
• protect go web forms from cross-site request forgery
• csrf middleware for any go framework handler
• exempt specific api endpoints from csrf checks
• mitigate breach attacks with masked csrf tokens
• custom error response for failed csrf validation

When to choose

• you need framework-agnostic CSRF protection for any Go http.Handler
• you want zero dependencies outside the Go standard library
• you need fine-grained endpoint exemptions via paths, globs, or regexes
• you want BREACH-resistant masked tokens

When to avoid

• your framework already ships built-in CSRF protection
• you need CSRF protection outside Go
• you need session-backed token storage with advanced rotation policies

Facets

library · maturity stable

middleware security http-server security web-development backend go csrf csrf-protection http-middleware breach-mitigation zero-dependency web-server

Member repositories

For agents

markdown · JSON · MCP: product_card(name="justinas/nosurf")