fix: replace gorilla/csrf with custom double-submit cookie CSRF

gorilla/csrf was causing 403 on all HTMX POST requests due to complex
token masking and HttpOnly cookie requirements that conflicted with
JavaScript-based token injection.

New approach: simple double-submit cookie pattern:
- GET sets a readable _csrf cookie (not HttpOnly)
- HTMX reads cookie via document.cookie and sends X-CSRF-Token header
- POST validates header matches cookie
- No gorilla dependency needed for CSRF

Author: Codex

internal/web/csrf.go

@@ -0,0 +1,68 @@
+package web
+
+import (
+	"crypto/rand"
+	"encoding/base64"
+	"net/http"
+)
+
+const csrfCookieName = "_csrf"
+const csrfHeaderName = "X-CSRF-Token"
+const csrfTokenLength = 32
+
+// CSRFMiddleware implements double-submit cookie CSRF protection.
+// On GET requests: sets a CSRF cookie if not present.
+// On POST/PUT/DELETE requests: validates that the X-CSRF-Token header matches the cookie.
+func CSRFMiddleware(next http.Handler) http.Handler {
+	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		switch r.Method {
+		case "GET", "HEAD", "OPTIONS":
+			// Safe methods — ensure CSRF cookie exists
+			if _, err := r.Cookie(csrfCookieName); err != nil {
+				token := generateCSRFToken()
+				http.SetCookie(w, &http.Cookie{
+					Name:     csrfCookieName,
+					Value:    token,
+					Path:     "/",
+					HttpOnly: false, // Must be readable by JavaScript
+					SameSite: http.SameSiteLaxMode,
+					MaxAge:   86400,
+				})
+			}
+			next.ServeHTTP(w, r)
+
+		default:
+			// Mutation methods — validate token
+			cookie, err := r.Cookie(csrfCookieName)
+			if err != nil || cookie.Value == "" {
+				http.Error(w, "CSRF cookie missing", http.StatusForbidden)
+				return
+			}
+			headerToken := r.Header.Get(csrfHeaderName)
+			if headerToken == "" {
+				headerToken = r.FormValue("csrf_token")
+			}
+			if headerToken != cookie.Value {
+				http.Error(w, "CSRF token mismatch", http.StatusForbidden)
+				return
+			}
+			next.ServeHTTP(w, r)
+		}
+	})
+}
+
+// GetCSRFToken extracts the CSRF token from the request cookie.
+// Used by handlers to pass the token to templates.
+func GetCSRFToken(r *http.Request) string {
+	cookie, err := r.Cookie(csrfCookieName)
+	if err != nil {
+		return ""
+	}
+	return cookie.Value
+}
+
+func generateCSRFToken() string {
+	b := make([]byte, csrfTokenLength)
+	rand.Read(b)
+	return base64.URLEncoding.EncodeToString(b)
+}

internal/web/handlers/report.go

@@ -20,7 +20,6 @@ import (
 	"reportbot/internal/web/templates"
 
 	"github.com/go-chi/chi/v5"
-	"github.com/gorilla/csrf"
 )
 
 // buildResultCache caches BuildResult per week to avoid re-running the LLM pipeline
@@ -133,7 +132,7 @@ func ReportEditorPage(cfg web.Config, db *sql.DB) http.HandlerFunc {
 			Sections:           sections,
 			AllSections:        allSections,
 			IsManager:          isManager,
-			CSRFToken:          csrf.Token(r),
+			CSRFToken:          web.GetCSRFToken(r),
 			Mode:               mode,
 			HasClassifications: hasClassifications,
 		}

internal/web/handlers/server.go

@@ -10,7 +10,6 @@ import (
 
 	"github.com/go-chi/chi/v5"
 	chimw "github.com/go-chi/chi/v5/middleware"
-	"github.com/gorilla/csrf"
 
 	"reportbot/internal/web"
 	mw "reportbot/internal/web/middleware"
@@ -25,16 +24,10 @@ func NewServer(cfg web.Config, db *sql.DB) *http.Server {
 	r.Use(chimw.Recoverer)
 
 	// Derive Secure flag from base URL scheme
-	isHTTPS := strings.HasPrefix(cfg.WebBaseURL, "https://")
-
-	// CSRF protection
-	csrfMiddleware := csrf.Protect(
-		[]byte(cfg.WebSessionSecret),
-		csrf.Secure(isHTTPS),
-		csrf.Path("/"),
-		csrf.RequestHeader("X-CSRF-Token"),
-	)
-	r.Use(csrfMiddleware)
+	_ = strings.HasPrefix(cfg.WebBaseURL, "https://")
+
+	// CSRF protection — double-submit cookie (replaces gorilla/csrf)
+	r.Use(web.CSRFMiddleware)
 
 	// Static files (embedded in web package)
 	staticFS, err := fs.Sub(web.StaticFiles, "static")

internal/web/templates/layout.templ

@@ -14,9 +14,10 @@ templ Layout(title string, csrfToken string, isManager bool, activePage string)
 		<body>
 			<script>
 				document.body.addEventListener('htmx:configRequest', function(e) {
-					var token = document.querySelector('meta[name="csrf-token"]');
-					if (token) {
-						e.detail.headers['X-CSRF-Token'] = token.content;
+					// Read CSRF token from cookie (double-submit cookie pattern)
+					var match = document.cookie.match(/(^|;\s*)_csrf=([^;]*)/);
+					if (match) {
+						e.detail.headers['X-CSRF-Token'] = decodeURIComponent(match[2]);
 					}
 				});
 			</script>