Comments (4)
from csrf.
Hey thanks for replying. It's not so much a problem per se but as I said before, it forces projects (or libraries) that want to use gorilla/csrf
to bring along an extra dependency, lightweight or not. I call it "extra" because it is not fundamental to gorilla/csrf
as is gorilla/securecookie
.
If we assume a project that depends on 10 small and good packages like gorilla/csrf
and each of them brings along a extra lightweight dependency then the project now has 20+ dependencies out of the blue.
I believe It is a good practice to keep libraries as self contained and lean as possible especially one as important to the ecosystem as gorilla/csrf
.
from csrf.
from csrf.
There is no doubt that pkg/errors
is an awesome package and pretty convenient but gorilla/csrf
can easily do without it. It can't do without gorilla/securecookie
though. That's the key difference.
I believe that If we do not try to minimize our dependencies we might eventually end up other like other language ecosystems where it is the norm for each library to bring along sneaky small dependencies and the end project accumulating dozens, or even hundreds of dependencies. Some codebases can go as far as to copy small dependencies to keep the dependency tree at a minimum. Or to reference the Go proverb: "A little copying is better than a little dependency." This practice is even more important for libraries that can be imported by other libraries before they end up in a project.
Anyways, you made it clear that there are no plans to remove the dependency and it seems we have a different philosophy on the subject so I believe there is nothing else to discuss. Thanks for listening.
from csrf.
Related Issues (20)
- [question] X-Csrf-Token is empty in Response headers (Secure is off) HOT 10
- [question] How to use gorilla/csrf for CSRF protection when authenticating with OpenID Connect? HOT 4
- Does gorilla-csrf really provide more security? HOT 7
- Default path can cause unexpected CSRF token rejections HOT 4
- [bug] Change default request header onto custom HOT 3
- csrf.go: ErrBadReferer due to empty r.URL.Host HOT 1
- [bug] Not providing token results in wrong error HOT 1
- [question] How do I set csrf token from React HOT 1
- Multiple _gorilla_csrf cookies create an issue HOT 2
- [bug] README.md does not mention the need to keep the CSRF key secret HOT 1
- user disabled/blocked cookies on their browser.
- [docs] HOT 1
- Cannot get basic version of in-browser Javascript application documentation working HOT 8
- Package is not `go get`able [bug] HOT 2
- CSRF middlware is not usable with go gin HOT 1
- [bug] Generate CSRF tokens for skipped requests
- Forbidden - CSRF token invalid
- [BUG] Middleware doesn't work with Chi HOT 1
- First request to protected endpoint fails, CSRF header is empty
- [Question] How to log HOT 1
Recommend Projects
-
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
-
Vue.js
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
-
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
-
TensorFlow
An Open Source Machine Learning Framework for Everyone
-
Django
The Web framework for perfectionists with deadlines.
-
Laravel
A PHP framework for web artisans
-
D3
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
-
Recommend Topics
-
javascript
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
-
web
Some thing interesting about web. New door for the world.
-
server
A server is a program made to process requests and deliver data to clients.
-
Machine learning
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
-
Visualization
Some thing interesting about visualization, use data art
-
Game
Some thing interesting about game, make everyone happy.
Recommend Org
-
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
-
Microsoft
Open source projects and samples from Microsoft.
-
Google
Google ❤️ Open Source for everyone.
-
Alibaba
Alibaba Open Source for everyone
-
D3
Data-Driven Documents codes.
-
Tencent
China tencent open source team.
from csrf.