feat(security): #286 implement csrf middleware

main.go

@@ -49,8 +49,7 @@ func run(ctx context.Context, database *sql.DB, env func(string) string) {
 	// init db
 	err := db.RunMigrations(database, "")
 	if err != nil {
-		log.Error("Could not run migrations: %v", err)
-		os.Exit(1)
+		log.Fatal("Could not run migrations: %v", err)
 	}
 
 	// init servers
@@ -78,7 +77,7 @@ func run(ctx context.Context, database *sql.DB, env func(string) string) {
 }
 
 func startServer(s *http.Server) {
-	log.Info("Starting server on %v", s.Addr)
+	log.Info("Starting server on %q", s.Addr)
 	if err := s.ListenAndServe(); err != nil && err != http.ErrServerClosed {
 		log.Error("error listening and serving: %v", err)
 	}
@@ -131,6 +130,7 @@ func createHandler(d *sql.DB, serverSettings *types.Settings) http.Handler {
 		middleware.Log,
 		middleware.ContentSecurityPolicy,
 		middleware.Cors(serverSettings),
+		middleware.CrossSiteRequestForgery(authService),
 		middleware.Corp,
 		middleware.Coop,
 	)