func CustomCORS() gin.HandlerFunc {
    return func(c *gin.Context) {
        origin := c.Request.Header.Get("Origin")
        
        allowedOrigins := map[string]bool{
            "https://example-frontend.com": true,
            "https://mobile.example.com":   true,
        }
        
        if allowedOrigins[origin] {
            c.Header("Access-Control-Allow-Origin", origin)
            c.Header("Access-Control-Allow-Credentials", "true")
            c.Header("Access-Control-Allow-Headers", "Content-Type, Authorization, X-CSRF-Token")
            c.Header("Access-Control-Allow-Methods", "GET, POST, PUT, DELETE, OPTIONS")
            c.Header("Access-Control-Max-Age", "86400")
        }
        
        if c.Request.Method == "OPTIONS" {
            c.AbortWithStatus(204)
            return
        }
        
        c.Next()
    }
}

func ValidateOrigin() gin.HandlerFunc {
    return func(c *gin.Context) {
        origin := c.Request.Header.Get("Origin")
        referer := c.Request.Header.Get("Referer")
        
        allowedOrigins := []string{
            "https://example-frontend.com",
            "https://mobile.example.com",
        }
        
        isValid := false
        for _, allowed := range allowedOrigins {
            if origin == allowed || strings.HasPrefix(referer, allowed) {
                isValid = true
                break
            }
        }
        
        if !isValid && origin != "" {
            c.JSON(403, gin.H{"error": "Forbidden: Untrusted origin"})
            c.Abort()
            return
        }
        
        c.Next()
    }
}

func SetSecureCookie(c *gin.Context, name, value string) {
    c.SetCookie(
        name,
        value,
        3600,
        "/",
        "example.com",
        true,  // secure (HTTPS only)
        true,  // httpOnly
    )
    
    c.SetSameSite(http.SameSiteStrictMode)
}

<!-- 攻击者网站 -->
<img src="https://bank.com/transfer?to=attacker&amount=10000" style="display:none">

package csrf

import (
    "crypto/rand"
    "encoding/base64"
    "errors"
    "sync"
    "time"
    "github.com/gin-gonic/gin"
)

type TokenManager struct {
    tokens map[string]*TokenInfo
    mu     sync.RWMutex
}

type TokenInfo struct {
    ExpiresAt time.Time
    UserID    string
}

var manager = &TokenManager{
    tokens: make(map[string]*TokenInfo),
}

func Generate(userID string) string {
    b := make([]byte, 32)
    rand.Read(b)
    token := base64.URLEncoding.EncodeToString(b)
    
    manager.mu.Lock()
    manager.tokens[token] = &TokenInfo{
        ExpiresAt: time.Now().Add(1 * time.Hour),
        UserID:    userID,
    }
    manager.mu.Unlock()
    
    return token
}

func Validate(token, userID string) error {
    manager.mu.RLock()
    info, exists := manager.tokens[token]
    manager.mu.RUnlock()
    
    if !exists {
        return errors.New("token not found")
    }
    
    if time.Now().After(info.ExpiresAt) {
        return errors.New("token expired")
    }
    
    if info.UserID != userID {
        return errors.New("token user mismatch")
    }
    
    manager.mu.Lock()
    delete(manager.tokens, token)
    manager.mu.Unlock()
    
    return nil
}

func Middleware() gin.HandlerFunc {
    return func(c *gin.Context) {
        if c.Request.Method == "GET" || c.Request.Method == "HEAD" || 
           c.Request.Method == "OPTIONS" {
            c.Next()
            return
        }
        
        userID, exists := c.Get("userID")
        if !exists {
            c.JSON(401, gin.H{"error": "Unauthorized"})
            c.Abort()
            return
        }
        
        token := c.GetHeader("X-CSRF-Token")
        if token == "" {
            token = c.PostForm("csrf_token")
        }
        
        if err := Validate(token, userID.(string)); err != nil {
            c.JSON(403, gin.H{"error": "Invalid CSRF token"})
            c.Abort()
            return
        }
        
        c.Next()
    }
}

async function transferMoney(to, amount) {
    const tokenResponse = await fetch('/api/csrf-token', {
        credentials: 'include'
    });
    const { csrf_token } = await tokenResponse.json();
    
    const response = await fetch('/api/transfer', {
        method: 'POST',
        headers: {
            'Content-Type': 'application/json',
            'X-CSRF-Token': csrf_token
        },
        credentials: 'include',
        body: JSON.stringify({ to, amount })
    });
    
    return response.json();
}

func ValidateReferer() gin.HandlerFunc {
    return func(c *gin.Context) {
        if c.Request.Method == "GET" {
            c.Next()
            return
        }
        
        referer := c.Request.Header.Get("Referer")
        origin := c.Request.Header.Get("Origin")
        
        allowedDomains := []string{
            "https://example.com",
            "https://www.example.com",
        }
        
        isValid := false
        for _, domain := range allowedDomains {
            if strings.HasPrefix(referer, domain) || origin == domain {
                isValid = true
                break
            }
        }
        
        if !isValid {
            c.JSON(403, gin.H{"error": "Invalid referer"})
            c.Abort()
            return
        }
        
        c.Next()
    }
}