> ## Documentation Index
> Fetch the complete documentation index at: https://docs.codeant.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Go net http handlefunc without gorilla csrf protection

<AccordionGroup>
  <Accordion title="go-net-http-handlefunc-without-gorilla-csrf-protection">
    The application does not appear to verify inbound requests which can lead to a Cross-site request forgery (CSRF) vulnerability. If the application uses cookie-based authentication, an attacker can trick users into sending authenticated HTTP requests without their knowledge from any arbitrary domain they visit. This vulnerability can be prevented by getting the CSRF token from the request and including it in a response header by including `$W.Header.Set(X-CSRF-Token", csrf.Token($R))` in the function before calling `$W.Write()`, or by wrapping the `$FUNC` call with `csrf.Protect(authKey)($FUNC)` and using a key retrieved for instance from an environment variable.<br />**Likelihood**: MEDIUM<br />**Confidence**: MEDIUM<br />**CWE**: <br />- CWE-352: Cross-Site Request Forgery (CSRF)
    <br />**OWASP**: <br />- A01:2021 - Broken Access Control
    <br />- A05:2017 - Broken Access Control
  </Accordion>
</AccordionGroup>