🐛 [Bug]: Csrf with Session store does not support secure cookie middleware #2743
Description
Bug Description
Store defined as
Store = session.New(
session.Config{
Expiration: setups.SessionExpiration,
KeyLookup: "header:Session-Id",
// Storage: ,// Redis on production/Memory on dev
CookieDomain: config.Conf.App.Domain,
CookieSecure: config.Conf.App.Secure, // True on HTTPS
CookieHTTPOnly: true,
},
)
Csrf Configuration
app.Use(csrf.New(csrf.Config{
CookieDomain: config.Conf.App.Domain,
CookieSecure: config.Conf.App.Secure, // HTTPS True
CookieHTTPOnly: true,
CookieSameSite: "Strict",
CookieSessionOnly: true, // Set True ignore expiration time
Session: Store,
ErrorHandler: defaultErrorHandler,
}))
This works perfect but if i enable secure cookie middleware
app.Use(encryptcookie.New(encryptcookie.Config{
Key: encryptcookie.GenerateKey(),
}))
csrf always returns forbidden
How to Reproduce
Enable secure cookie middleware when csrf storage uses session store
Expected Behavior
I expect it should also work when secure cookie middleware is in use
Fiber Version
2.51.0
Code Snippet (optional)
package main
import "github.com/gofiber/fiber/v2"
import "log"
func main() {
app := fiber.New()
// Steps to reproduce
log.Fatal(app.Listen(":3000"))
}Checklist:
- I agree to follow Fiber's Code of Conduct.
- I have checked for existing issues that describe my problem prior to opening this one.
- I understand that improperly formatted bug reports may be closed without explanation.