Add ability to disable CSRF

auth/handlers/routes.go

@@ -40,13 +40,15 @@ func (h *AuthHandlers) MountHttpRoutes(r chi.Router) {
 
 		r.Group(func(r chi.Router) {
 			// all routes protected with CSRF:
-			r.Use(csrf.Protect(
-				[]byte(h.Opt.CsrfSecret),
-				csrf.SameSite(csrf.SameSiteStrictMode),
-				csrf.Secure(h.Opt.SessionCookieSecure),
-				csrf.FieldName(h.Opt.CsrfFieldName),
-				csrf.CookieName(h.Opt.CsrfCookieName),
-			))
+			if h.Opt.CsrfEnabled {
+				r.Use(csrf.Protect(
+					[]byte(h.Opt.CsrfSecret),
+					csrf.SameSite(csrf.SameSiteStrictMode),
+					csrf.Secure(h.Opt.SessionCookieSecure),
+					csrf.FieldName(h.Opt.CsrfFieldName),
+					csrf.CookieName(h.Opt.CsrfCookieName),
+				))
+			}
 
 			r.Get(tbp(l.Profile), h.handle(authOnly(h.profileForm)))
 			r.Post(tbp(l.Profile), h.handle(authOnly(h.profileProc)))

pkg/options/auth.gen.go

@@ -30,6 +30,7 @@ type (
 		RequestRateLimit         int           `env:"AUTH_REQUEST_RATE_LIMIT"`
 		RequestRateWindowLength  time.Duration `env:"AUTH_REQUEST_RATE_WINDOW_LENGTH"`
 		CsrfSecret               string        `env:"AUTH_CSRF_SECRET"`
+		CsrfEnabled              bool          `env:"AUTH_CSRF_ENABLED"`
 		CsrfFieldName            string        `env:"AUTH_CSRF_FIELD_NAME"`
 		CsrfCookieName           string        `env:"AUTH_CSRF_COOKIE_NAME"`
 		DefaultClient            string        `env:"AUTH_DEFAULT_CLIENT"`
@@ -56,6 +57,7 @@ func Auth() (o *AuthOpt) {
 		RequestRateLimit:         30,
 		RequestRateWindowLength:  time.Minute,
 		CsrfSecret:               getSecretFromEnv("csrf secret"),
+		CsrfEnabled:              true,
 		CsrfFieldName:            "same-site-authenticity-token",
 		CsrfCookieName:           "same-site-authenticity-token",
 		DefaultClient:            "corteza-webapp",

pkg/options/auth.yaml

@@ -115,12 +115,17 @@ props:
       Generated secret will change if you change any of these variables.
       ====
 
+  - name: csrfEnabled
+    type: bool
+    default: true
+    description: |-
+      Enable CSRF protection
+
   - name: csrfFieldName
     default: "same-site-authenticity-token"
     description: |-
       Form field name used for CSRF protection
 
-
   - name: csrfCookieName
     default: "same-site-authenticity-token"
     description: |-