From 501984f2d350470043d7f84e57a47671759f4eca Mon Sep 17 00:00:00 2001
From: Rose Hogenson <rhogenson@google.com>
Date: Wed, 24 Sep 2025 08:26:10 -0700
Subject: Don't attach CSRF token on login

There's just no reason to
---
 roseh.moe.go | 33 ++++++++++++++-------------------
 1 file changed, 14 insertions(+), 19 deletions(-)

diff --git a/roseh.moe.go b/roseh.moe.go
index c8d61e9..044ae01 100644
--- a/roseh.moe.go
+++ b/roseh.moe.go
@@ -159,25 +159,9 @@ func attachCookie(w http.ResponseWriter) error {
 	return nil
 }
 
-func attachCSRFToken(w http.ResponseWriter) string {
+func cookieAuth(w http.ResponseWriter, r *http.Request) (string, bool) {
 	const csrfTokenLen = 32
 
-	buf := make([]byte, csrfTokenLen)
-	rand.Read(buf)
-	csrfToken := base64.RawStdEncoding.EncodeToString(buf)
-	http.SetCookie(w, &http.Cookie{
-		Name:        "csrf-token",
-		Value:       csrfToken,
-		Path:        "/notepad",
-		Secure:      true,
-		HttpOnly:    true,
-		SameSite:    http.SameSiteStrictMode,
-		Partitioned: true,
-	})
-	return csrfToken
-}
-
-func cookieAuth(w http.ResponseWriter, r *http.Request) (string, bool) {
 	cookie, err := r.Cookie("auth")
 	if err != nil {
 		return "", false
@@ -208,7 +192,19 @@ func cookieAuth(w http.ResponseWriter, r *http.Request) (string, bool) {
 	if csrfToken, err := r.Cookie("csrf-token"); err == nil {
 		return csrfToken.Value, true
 	}
-	csrfToken := attachCSRFToken(w)
+
+	buf := make([]byte, csrfTokenLen)
+	rand.Read(buf)
+	csrfToken := base64.RawStdEncoding.EncodeToString(buf)
+	http.SetCookie(w, &http.Cookie{
+		Name:        "csrf-token",
+		Value:       csrfToken,
+		Path:        "/notepad",
+		Secure:      true,
+		HttpOnly:    true,
+		SameSite:    http.SameSiteStrictMode,
+		Partitioned: true,
+	})
 	return csrfToken, true
 }
 
@@ -253,7 +249,6 @@ func login(w http.ResponseWriter, r *http.Request) {
 		encryptionKeyMu.Unlock()
 	}
 	attachCookie(w)
-	attachCSRFToken(w)
 	http.Redirect(w, r, r.FormValue("redirect"), http.StatusSeeOther)
 }
 
-- 
cgit v1.3.1