Resolves an issue where, when multiple CSRF cookies are set, a random one would be used to verif...

* feat: add disable

* ci: run on ubuntu latest

if h.IsIgnored(r) == true,this methond will return before in line 149 .

Closes #61

See #61

Resolve critical vulnerability allowing arbitrary tokens to pass as matching

Enforced a single point of token equality check for all functions. Added a test case to demonstr...

1.0 and 1.1 seem to be gone.

Return empty string if token does not exist in request context

Allow setting the name of the CSRF cookie

ReadME Fix: Replace `Token(r)` with `nosurf.Token(r)`

Simplify code, follow some linter suggestions

Send a response body in defaultFailureHandler

Append whole slice instead of append every single element

Remove reference to now-deleted examples directory

This was removed in 2e708f28095ba17463e41438bbfd53abae8b6794 to fix #34.

Besides, TestRegenerateToken never worked correctly in the first place

To be added back in a neater place

Use http.Error to also set text/plain content type. Fixes #31

Fixes #31

Expose VerifyToken.

Make reads of random bytes panic on error.

Since we check for availability of random reader on startup, errors on
rand.Reader probably won'...

testutils.go imports "testing" but is included in normal, non-test
builds. This results in any p...

rename testutils.go to testutils_test.go

Added *CSRFHandler.ExemptFunc, for matching on more complex rules

Changed references to encrypt/decrypt to mask/unmask.

Fleshed out Goji example to show how to apply a custom nosurf instance.

This change clarifies the actual operation taking place.

Added Goji (https://goji.io) + nosurf example.

Fixed possible typo.

http.Request.PostFormValue() is unavailable in Go 1.0.
The semantical difference between POST an...