CSRF：移植 Go 1.25 的跨源保护

        // Deliberately not Method::is_safe: it also treats TRACE as safe, but the
        // reference implementation only exempts GET/HEAD/OPTIONS, so we match it here.
        if matches!(
            req.method(),
            &Method::GET | &Method::HEAD | &Method::OPTIONS
        ) {
            return Ok(());
        }

        // Fetch spec mandates lowercase here; exact byte match is intentional.
        match sec_fetch_site {
            Some(b"same-origin" | b"none") => return Ok(()),
            None | Some(b"") => {} // fall through to Origin check
            Some(_) if is_exempt() => return Ok(()),
            Some(_) => {
                return Err(ProtectionError::new(
                    ProtectionErrorKind::CrossOriginRequest,
                ))
            }
        }

        // Mirrors the reference's `url.Parse(origin).Host == req.Host`. Per RFC 7230
        // §5.3, req.Host is the request-target authority (absolute-form URI / HTTP/2
        // `:authority`) if present, else the Host header. Byte-exact and scheme-blind,
        // so an http→https mismatch can't be caught here — we fail open (HSTS helps).
        let effective_host = req
            .uri()
            .authority()
            .map(|a| a.as_str().as_bytes())
            .or(host);

            Err(err) => {
                let mut response = self
                    .rejection_response
                    .response_for_protection_error(err.clone());

                response.extensions_mut().insert(err);

                ResponseFuture::rejected(Ok(response))
            }

tower-http = { version = "=0.7.1", features = ["csrf"] }
tower = { version = "=0.5.3", features = ["util"] }
tokio = { version = "=1.54.1", features = ["macros", "rt"] }
http = "1"
http-body-util = "0.1"
bytes = "1"

use bytes::Bytes;
use http::{Method, Request, Response, StatusCode};
use http_body_util::{BodyExt, Full};
use std::convert::Infallible;
use tower::{Layer, ServiceExt};
use tower_http::csrf::{CsrfLayer, ProtectionError};

async fn handler(_: Request<Full<Bytes>>) -> Result<Response<Full<Bytes>>, Infallible> {
  Ok(Response::new(Full::from("handled")))
}

async fn send<L>(layer: &L, name: &str, method: Method, uri: &str, headers: &[(&str, &str)])
where
  L: Layer<tower::util::ServiceFn<fn(Request<Full<Bytes>>) -> std::pin::Pin<Box<dyn std::future::Future<Output = Result<Response<Full<Bytes>>, Infallible>> + Send>>>>,
  L::Service: tower::Service<Request<Full<Bytes>>, Response = Response<Full<Bytes>>, Error = Infallible>,
{
  let mut req = Request::builder().method(method).uri(uri);
  for (k, v) in headers {
    req = req.header(*k, *v);
  }
  let f: fn(Request<Full<Bytes>>) -> _ = |r| Box::pin(handler(r)) as _;
  let res = layer.layer(tower::service_fn(f)).oneshot(req.body(Full::default()).unwrap()).await.unwrap();
  let kind = res.extensions().get::<ProtectionError>().map(|e| format!("{:?}", e.kind())).unwrap_or("-".into());
  let status = res.status();
  let body = res.into_body().collect().await.unwrap().to_bytes();
  println!("{name:<44} {} {kind} {body:?}", status.as_u16());
}

#[tokio::main(flavor = "current_thread")]
async fn main() {
  let layer = CsrfLayer::new().add_trusted_origin("https://partner.example").unwrap();
  let p = Method::POST;
  send(&layer, "TRACE, Sec-Fetch-Site: cross-site", Method::TRACE, "/", &[("sec-fetch-site", "cross-site")]).await;
  send(&layer, "POST, Sec-Fetch-Site: same-origin", p.clone(), "/", &[("sec-fetch-site", "same-origin")]).await;
  send(&layer, "POST, Sec-Fetch-Site: same-site", p.clone(), "/", &[("sec-fetch-site", "same-site")]).await;
  send(&layer, "POST, cross-site, trusted Origin", p.clone(), "/", &[("sec-fetch-site", "cross-site"), ("origin", "https://partner.example")]).await;
  send(&layer, "POST, no Sec-Fetch-Site, no Origin", p.clone(), "/", &[("host", "app.example")]).await;
  send(&layer, "POST, Origin https://app.example = Host", p.clone(), "/", &[("origin", "https://app.example"), ("host", "app.example")]).await;
  send(&layer, "POST, Origin http://app.example = Host", p.clone(), "/", &[("origin", "http://app.example"), ("host", "app.example")]).await;
  send(&layer, "POST, Origin https://evil.example", p.clone(), "/", &[("origin", "https://evil.example"), ("host", "app.example")]).await;
  send(&layer, "POST, Origin: null", p.clone(), "/", &[("origin", "null"), ("host", "app.example")]).await;
  send(&layer, "proxy: Host rewritten to backend:8080", p.clone(), "/", &[("origin", "https://app.example"), ("host", "backend:8080")]).await;
  send(&layer, "proxy, browser sends Sec-Fetch-Site", p.clone(), "/", &[("sec-fetch-site", "same-origin"), ("origin", "https://app.example"), ("host", "backend:8080")]).await;
  send(&layer, "absolute URI authority wins over Host", p.clone(), "http://app.example/", &[("origin", "https://app.example"), ("host", "backend:8080")]).await;

  let upper = CsrfLayer::new().add_trusted_origin("HTTPS://Partner.Example").unwrap();
  send(&upper, "trusted HTTPS://Partner.Example", p.clone(), "/", &[("sec-fetch-site", "cross-site"), ("origin", "https://partner.example")]).await;
  for bad in ["https://partner.example/", "partner.example", "https://pärtner.example"] {
    println!("add_trusted_origin({bad:?}): {}", CsrfLayer::new().add_trusted_origin(bad).unwrap_err());
  }

  let custom = CsrfLayer::new().with_rejection_response(|e: ProtectionError| {
    let mut res = Response::new(Full::from(format!("blocked: {e}")));
    *res.status_mut() = StatusCode::BAD_REQUEST;
    res
  });
  send(&custom, "custom rejection", p.clone(), "/", &[("sec-fetch-site", "cross-site")]).await;
  send(&custom, "custom rejection, old browser", p.clone(), "/", &[("origin", "https://evil.example"), ("host", "app.example")]).await;
}

TRACE, Sec-Fetch-Site: cross-site            403 CrossOriginRequest b""
POST, Sec-Fetch-Site: same-origin            200 - b"handled"
POST, Sec-Fetch-Site: same-site              403 CrossOriginRequest b""
POST, cross-site, trusted Origin             200 - b"handled"
POST, no Sec-Fetch-Site, no Origin           200 - b"handled"
POST, Origin https://app.example = Host      200 - b"handled"
POST, Origin http://app.example = Host       200 - b"handled"
POST, Origin https://evil.example            403 CrossOriginRequestFromOldBrowser b""
POST, Origin: null                           403 CrossOriginRequestFromOldBrowser b""
proxy: Host rewritten to backend:8080        403 CrossOriginRequestFromOldBrowser b""
proxy, browser sends Sec-Fetch-Site          200 - b"handled"
absolute URI authority wins over Host        200 - b"handled"
trusted HTTPS://Partner.Example              403 CrossOriginRequest b""
add_trusted_origin("https://partner.example/"): invalid origin "https://partner.example/": path, query, and fragment are not allowed
add_trusted_origin("partner.example"): invalid origin "partner.example": scheme must be http or https
add_trusted_origin("https://pärtner.example"): invalid origin "https://pärtner.example": non-ASCII hostnames must be supplied in punycode (xn--…)
custom rejection                             400 CrossOriginRequest b"blocked: Cross-Origin request detected"
custom rejection, old browser                400 CrossOriginRequestFromOldBrowser b"blocked: Cross-Origin request from old browser detected"