<commit_before>package csrf

import (
	"net/http"

	"github.com/zenazn/goji/web"
)

// Option describes a functional option for configuring the CSRF handler.
type Option func(*csrf) error

// MaxAge sets the maximum age (in seconds) of a CSRF token's underlying cookie.
// Defaults to 12 hours.
func MaxAge(age int) Option {
	return func(cs *csrf) error {
		cs.opts.MaxAge = age
		return nil
	}
}

// Domain sets the cookie domain. Defaults to the current domain of the request
// only (recommended).
//
// This should be a hostname and not a URL. If set, the domain is treated as
// being prefixed with a '.' - e.g. "example.com" becomes ".example.com" and
// matches "www.example.com" and "secure.example.com".
func Domain(domain string) Option {
	return func(cs *csrf) error {
		cs.opts.Domain = domain
		return nil
	}
}

// Path sets the cookie path. Defaults to the path the cookie was issued from
// (recommended).
//
// This instructs clients to only respond with cookie for that path and its
// subpaths - i.e. a cookie issued from "/register" would be included in requests
// to "/register/step2" and "/register/submit".
func Path(p string) Option {
	return func(cs *csrf) error {
		cs.opts.Path = p
		return nil
	}
}

// Secure sets the 'Secure' flag on the cookie. Defaults to true (recommended).
func Secure(s bool) Option {
	return func(cs *csrf) error {
		cs.opts.Secure = s
		return nil
	}
}

// HttpOnly sets the 'HttpOnly' flag on the cookie. Defaults to true (recommended).
func HttpOnly(h bool) Option {
	return func(cs *csrf) error {
		// Note that the function and field names match the case of the
		// related http.Cookie field instead of the "correct" HTTPOnly name
		// that golint suggests.
		cs.opts.HttpOnly = h
		return nil
	}
}

// ErrorHandler allows you to change the handler called when CSRF request
// processing encounters an invalid token or request. A typical use would be to
// provide a handler that returns a static HTML file with a HTTP 403 status. By
// default a HTTP 404 status and a plain text CSRF failure reason are served.
//
// Note that a custom error handler can also access the csrf.Failure(c, r)
// function to retrieve the CSRF validation reason from Goji's request context.
func ErrorHandler(h web.Handler) Option {
	return func(cs *csrf) error {
		cs.opts.ErrorHandler = h
		return nil
	}
}

// RequestHeader allows you to change the request header the CSRF middleware
// inspects. The default is X-CSRF-Token.<commit_msg>[docs] Corrected status code in docs (404 => 403).<commit_after>package csrf

import (
	"net/http"

	"github.com/zenazn/goji/web"
)

// Option describes a functional option for configuring the CSRF handler.
type Option func(*csrf) error

// MaxAge sets the maximum age (in seconds) of a CSRF token's underlying cookie.
// Defaults to 12 hours.
func MaxAge(age int) Option {
	return func(cs *csrf) error {
		cs.opts.MaxAge = age
		return nil
	}
}

// Domain sets the cookie domain. Defaults to the current domain of the request
// only (recommended).
//
// This should be a hostname and not a URL. If set, the domain is treated as
// being prefixed with a '.' - e.g. "example.com" becomes ".example.com" and
// matches "www.example.com" and "secure.example.com".
func Domain(domain string) Option {
	return func(cs *csrf) error {
		cs.opts.Domain = domain
		return nil
	}
}

// Path sets the cookie path. Defaults to the path the cookie was issued from
// (recommended).
//
// This instructs clients to only respond with cookie for that path and its
// subpaths - i.e. a cookie issued from "/register" would be included in requests
// to "/register/step2" and "/register/submit".
func Path(p string) Option {
	return func(cs *csrf) error {
		cs.opts.Path = p
		return nil
	}
}

// Secure sets the 'Secure' flag on the cookie. Defaults to true (recommended).
func Secure(s bool) Option {
	return func(cs *csrf) error {
		cs.opts.Secure = s
		return nil
	}
}

// HttpOnly sets the 'HttpOnly' flag on the cookie. Defaults to true (recommended).
func HttpOnly(h bool) Option {
	return func(cs *csrf) error {
		// Note that the function and field names match the case of the
		// related http.Cookie field instead of the "correct" HTTPOnly name
		// that golint suggests.
		cs.opts.HttpOnly = h
		return nil
	}
}

// ErrorHandler allows you to change the handler called when CSRF request
// processing encounters an invalid token or request. A typical use would be to
// provide a handler that returns a static HTML file with a HTTP 403 status. By
// default a HTTP 403 status and a plain text CSRF failure reason are served.
//
// Note that a custom error handler can also access the csrf.Failure(c, r)
// function to retrieve the CSRF validation reason from Goji's request context.
func ErrorHandler(h web.Handler) Option {
	return func(cs *csrf) error {
		cs.opts.ErrorHandler = h
		return nil
	}
}

// RequestHeader allows you to change the request header the CSRF middleware
// inspects. The default is X-CSRF-Token.
{'fraction_non_alphanumeric': 0.0935309433206489, 'fraction_numerical': 0.004806729421189666, 'mean_word_length': 3.320069204152249, 'pattern_counts': {'":': 0, '<': 3, '<?xml version=': 0, '>': 4, 'https://': 0, 'lorem ipsum': 0, 'www.': 2, 'xml': 0}, 'pii_count': 0, 'substrings_counts': 0, 'word_list_counts': {'cursed_substrings.json': 0, 'profanity_word_list.json': 0, 'sexual_word_list.json': 0, 'zh_pornsignals.json': 0}}
{'dir': 'git-commits-cleaned', 'id': '5056349', 'n_tokens_mistral': 1580, 'n_tokens_neox': 1499, 'n_words': 678}