fix(csrf): Replace gorilla/csrf with net/http.CrossOriginProtection

gorilla/csrf is pinned at v1.7.2 for CVE-2025-24358 and cannot move. Go 1.25's net/http.CrossOriginProtection covers the same ground, so drop the dependency and judge cross-origin writes with the standard library. No configured endpoint takes part: each request is judged on the origin the browser actually used, which is what lets one Harbor answer on several ingresses.

The fallback that runs when a browser sends no Sec-Fetch-Site (plain HTTP) compares Origin against Host. A proxy that rewrites Host drops the port — the bundled nginx sets Host to $host — so a legitimate same-origin write looks cross-origin. Tolerate a port-only difference on an otherwise matching host; a differing host still fails, keeping the cross-site and CVE-2025-24358 rejections intact.

Signed-off-by: Prasanth Baskar <prasanth@8gears.com>

Author: bupd

.github/renovate.json

@@ -134,13 +134,6 @@
         "docker"
       ]
     },
-    {
-      "description": "gorilla/csrf is deliberately pinned to v1.7.2 (goharbor/harbor#22010) — block the v1.7.3+ updates Renovate keeps proposing, including via vulnerability alerts",
-      "matchPackageNames": [
-        "github.com/gorilla/csrf"
-      ],
-      "allowedVersions": "<= 1.7.2"
-    },
     {
       "description": "Bare deps: commit type everywhere — overrides :semanticPrefixFixDepsChoreOthers from config:recommended, which would otherwise emit fix(deps)/chore(deps)",
       "matchPackageNames": [

src/go.mod

@@ -36,8 +36,6 @@ require (
 	github.com/gomodule/redigo v2.0.0+incompatible
 	github.com/google/go-containerregistry v0.22.0
 	github.com/google/uuid v1.6.0
-	// pin the github.com/gorilla/csrf to v1.7.2 because of issue https://github.com/goharbor/harbor/issues/22010
-	github.com/gorilla/csrf v1.7.2
 	github.com/gorilla/handlers v1.5.2
 	github.com/gorilla/mux v1.8.1
 	github.com/graph-gophers/dataloader v5.0.0+incompatible
@@ -156,7 +154,6 @@ require (
 	github.com/google/s2a-go v0.1.9 // indirect
 	github.com/googleapis/enterprise-certificate-proxy v0.3.20 // indirect
 	github.com/googleapis/gax-go/v2 v2.24.0 // indirect
-	github.com/gorilla/securecookie v1.1.2 // indirect
 	github.com/grpc-ecosystem/grpc-gateway/v2 v2.30.0 // indirect
 	github.com/h2non/parth v0.0.0-20190131123155-b4df798d6542 // indirect
 	github.com/hashicorp/golang-lru v1.0.2 // indirect

src/go.sum

@@ -3860,18 +3860,13 @@ github.com/gopherjs/gopherjs v0.0.0-20181017120253-0766667cb4d1/go.mod h1:wJfORR
 github.com/gopherjs/gopherjs v1.17.2 h1:fQnZVsXk8uxXIStYb0N4bGk7jeyTalG/wsZjQ25dO0g=
 github.com/gopherjs/gopherjs v1.17.2/go.mod h1:pRRIvn/QzFLrKfvEz3qUuEhtE/zLCWfreZ6J5gM2i+k=
 github.com/gorilla/context v1.1.1/go.mod h1:kBGZzfjB9CEq2AlWe17Uuf7NDRt0dE0s8S51q0aT7Yg=
-github.com/gorilla/csrf v1.7.2 h1:oTUjx0vyf2T+wkrx09Trsev1TE+/EbDAeHtSTbtC2eI=
-github.com/gorilla/csrf v1.7.2/go.mod h1:F1Fj3KG23WYHE6gozCmBAezKookxbIvUJT+121wTuLk=
 github.com/gorilla/handlers v1.5.2 h1:cLTUSsNkgcwhgRqvCNmdbRWG0A3N4F+M2nWKdScwyEE=
 github.com/gorilla/handlers v1.5.2/go.mod h1:dX+xVpaxdSw+q0Qek8SSsl3dfMk3jNddUkMzo0GtH0w=
 github.com/gorilla/mux v1.6.2/go.mod h1:1lud6UwP+6orDFRuTfBEV8e9/aOM/c4fVVCaMa2zaAs=
 github.com/gorilla/mux v1.7.3/go.mod h1:1lud6UwP+6orDFRuTfBEV8e9/aOM/c4fVVCaMa2zaAs=
 github.com/gorilla/mux v1.8.0/go.mod h1:DVbg23sWSpFRCP0SfiEN6jmj59UnW/n46BH5rLB71So=
 github.com/gorilla/mux v1.8.1 h1:TuBL49tXwgrFYWhqrNgrUNEY92u81SPhu7sTdzQEiWY=
 github.com/gorilla/mux v1.8.1/go.mod h1:AKf9I4AEqPTmMytcMc0KkNouC66V3BtZ4qD5fmWSiMQ=
-github.com/gorilla/securecookie v1.1.1/go.mod h1:ra0sb63/xPlUeL+yeDciTfxMRAA+MP+HVt/4epWDjd4=
-github.com/gorilla/securecookie v1.1.2 h1:YCIWL56dvtr73r6715mJs5ZvhtnY73hBvEF8kXD8ePA=
-github.com/gorilla/securecookie v1.1.2/go.mod h1:NfCASbcHqRSY+3a8tlWJwsQap2VX5pwzwo4h3eOamfo=
 github.com/gorilla/sessions v1.2.1/go.mod h1:dk2InVEVJ0sfLlnXv9EAgkf6ecYs/i80K/zI+bUmuGM=
 github.com/gorilla/websocket v0.0.0-20170926233335-4201258b820c/go.mod h1:E7qHFY5m1UJ88s3WnNqhKjPHQ0heANvMoAMk2YaljkQ=
 github.com/graph-gophers/dataloader v5.0.0+incompatible h1:R+yjsbrNq1Mo3aPG+Z/EKYrXrXXUNJHOgbRt+U6jOug=

src/server/middleware/csrf/csrf.go

@@ -15,78 +15,105 @@
 package csrf
 
 import (
+	"net"
 	"net/http"
-	"os"
+	"net/url"
+	"slices"
 	"strings"
-	"sync"
 
-	"github.com/gorilla/csrf"
-
-	"github.com/goharbor/harbor/src/common/utils"
 	"github.com/goharbor/harbor/src/lib"
-	"github.com/goharbor/harbor/src/lib/config"
 	"github.com/goharbor/harbor/src/lib/errors"
 	lib_http "github.com/goharbor/harbor/src/lib/http"
 	"github.com/goharbor/harbor/src/lib/log"
 	"github.com/goharbor/harbor/src/server/middleware"
 )
 
-const (
-	csrfKeyEnv  = "CSRF_KEY"
-	tokenHeader = "X-Harbor-CSRF-Token"
-)
+// protect judges each request on the origin that browser actually used, so it
+// needs no configuration and is safe for concurrent use.
+var protect = http.NewCrossOriginProtection()
 
-var (
-	once       sync.Once
-	secureFlag = true
-	protect    func(handler http.Handler) http.Handler
-)
+// safeMethods are the methods RFC 7231 defines as safe, which carry no state
+// change and so need no cross-origin check.
+var safeMethods = []string{http.MethodGet, http.MethodHead, http.MethodOptions}
 
-// attachToken makes sure if csrf generate a new token it will be included in the response header
-func attachToken(w http.ResponseWriter, r *http.Request) {
-	if t := csrf.Token(r); len(t) > 0 {
-		w.Header().Set(tokenHeader, t)
-	} else {
-		log.Warningf("token not found in context, skip attaching")
+// check applies the cross-origin protection, then closes the one gap it leaves
+// open by design.
+//
+// CrossOriginProtection admits a request carrying neither Sec-Fetch-Site nor
+// Origin, reading it as non-browser traffic. That is the right default for a
+// library, but not here: csrfSkipper has already excused the registry, API and
+// service routes that non-browser clients use, so an unsafe request arriving
+// without either header is one we cannot vouch for. Refusing it matches what the
+// previous token scheme did, which rejected any write that failed to present a
+// token.
+func check(req *http.Request) error {
+	if err := protect.Check(req); err != nil {
+		// protect.Check compares Origin against Host including the port. Browsers
+		// send no Sec-Fetch-Site over plain HTTP, so the check falls to that
+		// comparison, and a proxy that rewrites Host drops the port from it — the
+		// bundled nginx sets Host to $host — making a legitimate same-origin write
+		// look cross-origin. Re-admit exactly that: no Sec-Fetch-Site, and an
+		// Origin whose host matches the request Host once the port is set aside.
+		if req.Header.Get("Sec-Fetch-Site") == "" && originHostMatchesIgnoringPort(req) {
+			return nil
+		}
+		return err
 	}
+
+	if slices.Contains(safeMethods, req.Method) {
+		return nil
+	}
+
+	if req.Header.Get("Sec-Fetch-Site") == "" && req.Header.Get("Origin") == "" {
+		return errors.New("request carries neither Sec-Fetch-Site nor Origin, cannot confirm its origin")
+	}
+
+	return nil
 }
 
-func handleError(w http.ResponseWriter, r *http.Request) {
-	attachToken(w, r)
-	lib_http.SendError(w, errors.New(csrf.FailureReason(r)).WithCode(errors.ForbiddenCode))
+// originHostMatchesIgnoringPort reports whether the request's Origin names the
+// same host as the request targeted, disregarding the port. A differing host —
+// a foreign site or a sibling subdomain — never matches, so the cross-site and
+// CVE-2025-24358 rejections stand.
+func originHostMatchesIgnoringPort(req *http.Request) bool {
+	origin := req.Header.Get("Origin")
+	if origin == "" {
+		return false
+	}
+	o, err := url.Parse(origin)
+	if err != nil || o.Hostname() == "" {
+		return false
+	}
+	return o.Hostname() == hostname(req.Host)
 }
 
-func attach(handler http.Handler) http.Handler {
-	return http.HandlerFunc(func(rw http.ResponseWriter, req *http.Request) {
-		attachToken(rw, req)
-		handler.ServeHTTP(rw, req)
-	})
+// hostname returns the host of a Host header or authority without any port and
+// without IPv6 brackets, so it can be compared to url.URL.Hostname.
+func hostname(host string) string {
+	if h, _, err := net.SplitHostPort(host); err == nil {
+		return h
+	}
+	return strings.Trim(host, "[]")
 }
 
-// Middleware initialize the middleware to apply csrf selectively
+// Middleware rejects cross-origin requests that carry a session. It reads the
+// Fetch metadata headers browsers have sent since 2023, falling back to
+// comparing Origin against the Host the client addressed.
+//
+// Deliberately no configured endpoint takes part in the decision. Harbor is
+// commonly reachable on several ingresses, over different schemes, behind
+// proxies that rewrite Host; a single configured origin describes none of that,
+// and every attempt to reconstruct "the" expected origin gets one of those
+// deployments wrong.
 func Middleware() func(handler http.Handler) http.Handler {
-	once.Do(func() {
-		key := os.Getenv(csrfKeyEnv)
-		if len(key) == 0 {
-			key = utils.GenerateRandomString()
-		} else if len(key) != 32 {
-			log.Errorf("Invalid CSRF key length from the environment: %s. Please ensure the key length is 32 characters.", key)
-			protect = func(_ http.Handler) http.Handler {
-				return http.HandlerFunc(func(w http.ResponseWriter, _ *http.Request) {
-					lib_http.SendError(w, errors.New("invalid CSRF key length from the environment. Please ensure the key length is 32 characters"))
-				})
-			}
+	return middleware.New(func(rw http.ResponseWriter, req *http.Request, next http.Handler) {
+		if err := check(req); err != nil {
+			log.Debugf("Rejected cross-origin request for %s: %v", lib.TrimLineBreaks(req.URL.Path), err)
+			lib_http.SendError(rw, errors.New(err).WithCode(errors.ForbiddenCode))
 			return
 		}
-		secureFlag = secureCookie()
-		protect = csrf.Protect([]byte(key), csrf.RequestHeader(tokenHeader),
-			csrf.Secure(secureFlag),
-			csrf.ErrorHandler(http.HandlerFunc(handleError)),
-			csrf.SameSite(csrf.SameSiteStrictMode),
-			csrf.Path("/"))
-	})
-	return middleware.New(func(rw http.ResponseWriter, req *http.Request, next http.Handler) {
-		protect(attach(next)).ServeHTTP(rw, req)
+
+		next.ServeHTTP(rw, req)
 	}, csrfSkipper)
 }
 
@@ -100,12 +127,3 @@ func csrfSkipper(req *http.Request) bool {
 	}
 	return false
 }
-
-func secureCookie() bool {
-	ep, err := config.ExtEndpoint()
-	if err != nil {
-		log.Warningf("Failed to get external endpoint: %v, set cookie secure flag to true", err)
-		return true
-	}
-	return !strings.HasPrefix(strings.ToLower(ep), "http://")
-}