fix XSRF

andeya · Apr 9, 2018 · 4ea7f27 · 4ea7f27
1 parent b97d794
commit 4ea7f27
Showing 1 changed file with 4 additions and 3 deletions.
diff --git a/context.go b/context.go
@@ -178,15 +178,16 @@ func (ctx *Context) checkXSRFCookie() bool {
 		return true
 	}
 	token := ctx.BizParam("_xsrf")
-	if token == "" {
-		token = ctx.CookieParam("_xsrf")
-	}
 	if token == "" {
 		token = ctx.R.Header.Get("X-Xsrftoken")
 	}
 	if token == "" {
 		token = ctx.R.Header.Get("X-Csrftoken")
 	}
+	// default cookie value
+	if token == "" {
+		token, _ = ctx.SecureCookieParam(ctx.frame.config.XSRF.Key, "_xsrf")
+	}
 	if token == "" {
 		ctx.Error(403, "'_xsrf' argument missing from POST")
 		return false