Google GitGoogle Git
Sign in
go/net/93d1f25be95961edfdf488b9398e53fb9f05f193
commit
93d1f25be95961edfdf488b9398e53fb9f05f193
[log]
author
Damien Neil <dneil@google.com>
Tue Jun 23 16:30:13 2026 -0700
committer
Damien Neil <dneil@google.com>
Wed Jun 24 07:54:26 2026 -0700
tree
40f49fcdd7ce9d2f70d538a892a7f965715506b1
parent
5a3baee349e65853c34b4377bebe7676a64dbc87 [diff]
xsrftoken: avoid token collisions

Adjust token sanitization to avoid collisions.
For example, previously ("u:", "a") and ("u", ":a")
both produced the (pre-hashing) token "u:::a:<timestamp>".

Fixes golang/go#80125

Change-Id: Ia932b762096abaa32bb790999c8e21e56a6a6964
Reviewed-on: https://go-review.googlesource.com/c/net/+/793540
LUCI-TryBot-Result: golang-scoped@luci-project-accounts.iam.gserviceaccount.com <golang-scoped@luci-project-accounts.iam.gserviceaccount.com>
Reviewed-by: Nicholas Husin <nsh@golang.org>
Reviewed-by: Nicholas Husin <husin@google.com>
2 files changed
tree: 40f49fcdd7ce9d2f70d538a892a7f965715506b1
  1. bpf/
  2. context/
  3. dict/
  4. dns/
  5. html/
  6. http/
  7. http2/
  8. http3/
  9. icmp/
  10. idna/
  11. internal/
  12. ipv4/
  13. ipv6/
  14. lif/
  15. nettest/
  16. netutil/
  17. proxy/
  18. publicsuffix/
  19. quic/
  20. route/
  21. trace/
  22. webdav/
  23. websocket/
  24. xsrftoken/
  25. .gitattributes
  26. .gitignore
  27. codereview.cfg
  28. CONTRIBUTING.md
  29. go.mod
  30. go.sum
  31. LICENSE
  32. PATENTS
  33. README.md
README.md

Go Networking

Go Reference

This repository holds supplementary Go networking packages.

Report Issues / Send Patches

This repository uses Gerrit for code changes. To learn how to submit changes to this repository, see https://go.dev/doc/contribute.

The git repository is https://go.googlesource.com/net.

The main issue tracker for the net repository is located at https://go.dev/issues. Prefix your issue with “x/net:” in the subject line, so it is easy to find.