fix(csrf): Replace gorilla/csrf with net/http.CrossOriginProtection

govulncheck reported Harbor's own code as affected by CVE-2025-24358, with a
call trace through server/middleware/csrf/csrf.go. The fix is gorilla/csrf
v1.7.3, and we were pinned below it on purpose: v1.7.3 broke HTTP-only logins
(goharbor/harbor#22010), upstream reverted, and .github/renovate.json was taught
to block the bump. There was no way out of that while the dependency stayed.

Lifting the pin was tried first and does not work. v1.7.3 reconstructs the
origin it expects from a presumed scheme plus the Host header, and neither
survives a proxy. Against a real HTTP deployment behind Harbor's own nginx:

  - nginx sends 'proxy_set_header Host $host', which drops the port, so the
    library compared 192.168.0.5 against the browser's 192.168.0.5:8099 and
    answered 403 even with the plaintext flag set.
  - The plaintext flag is one global boolean off EXT_ENDPOINT's scheme. On a
    deployment answering as us./eu./harbor.dev over https with EXT_ENDPOINT on
    http, every ingress returned 403. One flag cannot describe N ingresses.

CrossOriginProtection judges each request on the origin the browser actually
used. Sec-Fetch-Site decides it, and no configured endpoint, Host or scheme
enters the decision, so several ingresses on different schemes behind
Host-rewriting proxies all work with nothing to configure. All four hostnames
answer 200 in that same deployment.

It also closes the attack the token scheme let through. A sibling subdomain is
same-site, so SameSite=Strict still sent _gorilla_csrf and the subdomain could
write cookies on the parent domain, making both halves of the double submit
attacker-controlled; only the Origin check stood in the way, and CVE-2025-24358
is that the check never ran. That request is now refused.

One gap is closed beyond what the library does. CrossOriginProtection admits a
request carrying neither Sec-Fetch-Site nor Origin, reading it as non-browser
traffic. csrfSkipper has already excused the registry, API and service routes
that non-browser clients use, so an unsafe request arriving without either
header is refused instead, matching the token scheme which rejected any write
presenting no token.

gorilla/csrf and gorilla/securecookie leave go.mod and the Renovate pin goes
with them. govulncheck drops from one affected vulnerability to none, and no
longer reports CVE-2025-47909 either, which has no fix in any release.

csrfSkipper is untouched. CSRF_KEY is now inert and the portal's token
interceptor is dead code; both degrade quietly and are removed separately rather
than folded into a security fix.

Signed-off-by: Prasanth Baskar <prasanth@8gears.com>

Author: bupd

.github/renovate.json

@@ -134,13 +134,6 @@
         "docker"
       ]
     },
-    {
-      "description": "gorilla/csrf is deliberately pinned to v1.7.2 (goharbor/harbor#22010) — block the v1.7.3+ updates Renovate keeps proposing, including via vulnerability alerts",
-      "matchPackageNames": [
-        "github.com/gorilla/csrf"
-      ],
-      "allowedVersions": "<= 1.7.2"
-    },
     {
       "description": "Bare deps: commit type everywhere — overrides :semanticPrefixFixDepsChoreOthers from config:recommended, which would otherwise emit fix(deps)/chore(deps)",
       "matchPackageNames": [

src/go.mod

@@ -36,8 +36,6 @@ require (
 	github.com/gomodule/redigo v2.0.0+incompatible
 	github.com/google/go-containerregistry v0.22.0
 	github.com/google/uuid v1.6.0
-	// pin the github.com/gorilla/csrf to v1.7.2 because of issue https://github.com/goharbor/harbor/issues/22010
-	github.com/gorilla/csrf v1.7.2
 	github.com/gorilla/mux v1.8.1
 	github.com/graph-gophers/dataloader v5.0.0+incompatible
 	github.com/jackc/pgx/v5 v5.10.0
@@ -154,7 +152,6 @@ require (
 	github.com/google/s2a-go v0.1.9 // indirect
 	github.com/googleapis/enterprise-certificate-proxy v0.3.20 // indirect
 	github.com/googleapis/gax-go/v2 v2.24.0 // indirect
-	github.com/gorilla/securecookie v1.1.2 // indirect
 	github.com/grpc-ecosystem/grpc-gateway/v2 v2.30.0 // indirect
 	github.com/h2non/parth v0.0.0-20190131123155-b4df798d6542 // indirect
 	github.com/hashicorp/golang-lru v1.0.2 // indirect

src/go.sum

@@ -3767,8 +3767,6 @@ github.com/google/go-querystring v1.1.0/go.mod h1:Kcdr2DB4koayq7X8pmAG4sNG59So17
 github.com/google/go-querystring v1.2.0 h1:yhqkPbu2/OH+V9BfpCVPZkNmUXhb2gBxJArfhIxNtP0=
 github.com/google/go-querystring v1.2.0/go.mod h1:8IFJqpSRITyJ8QhQ13bmbeMBDfmeEJZD5A0egEOmkqU=
 github.com/google/gofuzz v1.0.0/go.mod h1:dBl0BpW6vV/+mYPU4Po3pmUjxk6FQPldtuIdl/M65Eg=
-github.com/google/gofuzz v1.2.0 h1:xRy4A+RhZaiKjJ1bPfwQ8sedCA+YS2YcCHW6ec7JMi0=
-github.com/google/gofuzz v1.2.0/go.mod h1:dBl0BpW6vV/+mYPU4Po3pmUjxk6FQPldtuIdl/M65Eg=
 github.com/google/martian v2.1.0+incompatible/go.mod h1:9I4somxYTbIHy5NJKHRl3wXiIaQGbYVAs8BPL6v8lEs=
 github.com/google/martian/v3 v3.0.0/go.mod h1:y5Zk1BBys9G+gd6Jrk0W3cC1+ELVxBWuIGO+w/tUAp0=
 github.com/google/martian/v3 v3.1.0/go.mod h1:y5Zk1BBys9G+gd6Jrk0W3cC1+ELVxBWuIGO+w/tUAp0=
@@ -3860,16 +3858,12 @@ github.com/gopherjs/gopherjs v0.0.0-20181017120253-0766667cb4d1/go.mod h1:wJfORR
 github.com/gopherjs/gopherjs v1.17.2 h1:fQnZVsXk8uxXIStYb0N4bGk7jeyTalG/wsZjQ25dO0g=
 github.com/gopherjs/gopherjs v1.17.2/go.mod h1:pRRIvn/QzFLrKfvEz3qUuEhtE/zLCWfreZ6J5gM2i+k=
 github.com/gorilla/context v1.1.1/go.mod h1:kBGZzfjB9CEq2AlWe17Uuf7NDRt0dE0s8S51q0aT7Yg=
-github.com/gorilla/csrf v1.7.2 h1:oTUjx0vyf2T+wkrx09Trsev1TE+/EbDAeHtSTbtC2eI=
-github.com/gorilla/csrf v1.7.2/go.mod h1:F1Fj3KG23WYHE6gozCmBAezKookxbIvUJT+121wTuLk=
 github.com/gorilla/mux v1.6.2/go.mod h1:1lud6UwP+6orDFRuTfBEV8e9/aOM/c4fVVCaMa2zaAs=
 github.com/gorilla/mux v1.7.3/go.mod h1:1lud6UwP+6orDFRuTfBEV8e9/aOM/c4fVVCaMa2zaAs=
 github.com/gorilla/mux v1.8.0/go.mod h1:DVbg23sWSpFRCP0SfiEN6jmj59UnW/n46BH5rLB71So=
 github.com/gorilla/mux v1.8.1 h1:TuBL49tXwgrFYWhqrNgrUNEY92u81SPhu7sTdzQEiWY=
 github.com/gorilla/mux v1.8.1/go.mod h1:AKf9I4AEqPTmMytcMc0KkNouC66V3BtZ4qD5fmWSiMQ=
 github.com/gorilla/securecookie v1.1.1/go.mod h1:ra0sb63/xPlUeL+yeDciTfxMRAA+MP+HVt/4epWDjd4=
-github.com/gorilla/securecookie v1.1.2 h1:YCIWL56dvtr73r6715mJs5ZvhtnY73hBvEF8kXD8ePA=
-github.com/gorilla/securecookie v1.1.2/go.mod h1:NfCASbcHqRSY+3a8tlWJwsQap2VX5pwzwo4h3eOamfo=
 github.com/gorilla/sessions v1.2.1/go.mod h1:dk2InVEVJ0sfLlnXv9EAgkf6ecYs/i80K/zI+bUmuGM=
 github.com/gorilla/websocket v0.0.0-20170926233335-4201258b820c/go.mod h1:E7qHFY5m1UJ88s3WnNqhKjPHQ0heANvMoAMk2YaljkQ=
 github.com/graph-gophers/dataloader v5.0.0+incompatible h1:R+yjsbrNq1Mo3aPG+Z/EKYrXrXXUNJHOgbRt+U6jOug=

src/server/middleware/csrf/csrf.go

@@ -16,77 +16,68 @@ package csrf
 
 import (
 	"net/http"
-	"os"
+	"slices"
 	"strings"
-	"sync"
 
-	"github.com/gorilla/csrf"
-
-	"github.com/goharbor/harbor/src/common/utils"
 	"github.com/goharbor/harbor/src/lib"
-	"github.com/goharbor/harbor/src/lib/config"
 	"github.com/goharbor/harbor/src/lib/errors"
 	lib_http "github.com/goharbor/harbor/src/lib/http"
 	"github.com/goharbor/harbor/src/lib/log"
 	"github.com/goharbor/harbor/src/server/middleware"
 )
 
-const (
-	csrfKeyEnv  = "CSRF_KEY"
-	tokenHeader = "X-Harbor-CSRF-Token"
-)
+// protect judges each request on the origin that browser actually used, so it
+// needs no configuration and is safe for concurrent use.
+var protect = http.NewCrossOriginProtection()
 
-var (
-	once       sync.Once
-	secureFlag = true
-	protect    func(handler http.Handler) http.Handler
-)
+// safeMethods are the methods RFC 7231 defines as safe, which carry no state
+// change and so need no cross-origin check.
+var safeMethods = []string{http.MethodGet, http.MethodHead, http.MethodOptions}
 
-// attachToken makes sure if csrf generate a new token it will be included in the response header
-func attachToken(w http.ResponseWriter, r *http.Request) {
-	if t := csrf.Token(r); len(t) > 0 {
-		w.Header().Set(tokenHeader, t)
-	} else {
-		log.Warningf("token not found in context, skip attaching")
+// check applies the cross-origin protection, then closes the one gap it leaves
+// open by design.
+//
+// CrossOriginProtection admits a request carrying neither Sec-Fetch-Site nor
+// Origin, reading it as non-browser traffic. That is the right default for a
+// library, but not here: csrfSkipper has already excused the registry, API and
+// service routes that non-browser clients use, so an unsafe request arriving
+// without either header is one we cannot vouch for. Refusing it matches what the
+// previous token scheme did, which rejected any write that failed to present a
+// token.
+func check(req *http.Request) error {
+	if err := protect.Check(req); err != nil {
+		return err
 	}
-}
 
-func handleError(w http.ResponseWriter, r *http.Request) {
-	attachToken(w, r)
-	lib_http.SendError(w, errors.New(csrf.FailureReason(r)).WithCode(errors.ForbiddenCode))
-}
+	if slices.Contains(safeMethods, req.Method) {
+		return nil
+	}
+
+	if req.Header.Get("Sec-Fetch-Site") == "" && req.Header.Get("Origin") == "" {
+		return errors.New("request carries neither Sec-Fetch-Site nor Origin, cannot confirm its origin")
+	}
 
-func attach(handler http.Handler) http.Handler {
-	return http.HandlerFunc(func(rw http.ResponseWriter, req *http.Request) {
-		attachToken(rw, req)
-		handler.ServeHTTP(rw, req)
-	})
+	return nil
 }
 
-// Middleware initialize the middleware to apply csrf selectively
+// Middleware rejects cross-origin requests that carry a session. It reads the
+// Fetch metadata headers browsers have sent since 2023, falling back to
+// comparing Origin against the Host the client addressed.
+//
+// Deliberately no configured endpoint takes part in the decision. Harbor is
+// commonly reachable on several ingresses, over different schemes, behind
+// proxies that rewrite Host; a single configured origin describes none of that,
+// and every attempt to reconstruct "the" expected origin gets one of those
+// deployments wrong.
 func Middleware() func(handler http.Handler) http.Handler {
-	once.Do(func() {
-		key := os.Getenv(csrfKeyEnv)
-		if len(key) == 0 {
-			key = utils.GenerateRandomString()
-		} else if len(key) != 32 {
-			log.Errorf("Invalid CSRF key length from the environment: %s. Please ensure the key length is 32 characters.", key)
-			protect = func(_ http.Handler) http.Handler {
-				return http.HandlerFunc(func(w http.ResponseWriter, _ *http.Request) {
-					lib_http.SendError(w, errors.New("invalid CSRF key length from the environment. Please ensure the key length is 32 characters"))
-				})
-			}
+	return middleware.New(func(rw http.ResponseWriter, req *http.Request, next http.Handler) {
+		if err := check(req); err != nil {
+			log.Debugf("Rejected cross-origin request for %s: %v", lib.TrimLineBreaks(req.URL.Path), err)
+			lib_http.SendError(rw, errors.New(err).WithCode(errors.ForbiddenCode))
 			return
 		}
-		secureFlag = secureCookie()
-		protect = csrf.Protect([]byte(key), csrf.RequestHeader(tokenHeader),
-			csrf.Secure(secureFlag),
-			csrf.ErrorHandler(http.HandlerFunc(handleError)),
-			csrf.SameSite(csrf.SameSiteStrictMode),
-			csrf.Path("/"))
-	})
-	return middleware.New(func(rw http.ResponseWriter, req *http.Request, next http.Handler) {
-		protect(attach(next)).ServeHTTP(rw, req)
+
+		next.ServeHTTP(rw, req)
 	}, csrfSkipper)
 }
 
@@ -100,12 +91,3 @@ func csrfSkipper(req *http.Request) bool {
 	}
 	return false
 }
-
-func secureCookie() bool {
-	ep, err := config.ExtEndpoint()
-	if err != nil {
-		log.Warningf("Failed to get external endpoint: %v, set cookie secure flag to true", err)
-		return true
-	}
-	return !strings.HasPrefix(strings.ToLower(ep), "http://")
-}