func csrfTokenFromForm(param string) csrfTokenExtractor {
	return func(c nio.Context) (string, error) {
		token := c.FormValue(param)
		if token == "" {
			return "", errors.New("missing csrf token in the form parameter")
		}
		return token, nil
	}
}
csrfTokenFromForm returns a `csrfTokenExtractor` that extracts token from the
provided form parameter.
package mw
import (
	"crypto/subtle"
	"errors"
	"net/http"
	"strings"
	"time"
	"github.com/go-nio/nio"
	"github.com/go-nio/nio/internal/random"
)
type (
	CSRFConfig struct {
		Skipper nio.Skipper
		TokenLength uint8 `yaml:"token_length"`
		TokenLookup string `yaml:"token_lookup"`
		ContextKey string `yaml:"context_key"`
		CookieName string `yaml:"cookie_name"`
		CookieDomain string `yaml:"cookie_domain"`
		CookiePath string `yaml:"cookie_path"`
		CookieMaxAge int `yaml:"cookie_max_age"`
		CookieSecure bool `yaml:"cookie_secure"`
		CookieHTTPOnly bool `yaml:"cookie_http_only"`
	}
	csrfTokenExtractor func(nio.Context) (string, error)
)
var (
	DefaultCSRFConfig = CSRFConfig{
		Skipper:      nio.DefaultSkipper,
		TokenLength:  32,
		TokenLookup:  "header:" + nio.HeaderXCSRFToken,
		ContextKey:   "csrf",
		CookieName:   "_csrf",
		CookieMaxAge: 86400,
	}
)
func CSRF() nio.MiddlewareFunc {
	c := DefaultCSRFConfig
	return CSRFWithConfig(c)
}
func CSRFWithConfig(config CSRFConfig) nio.MiddlewareFunc {
	if config.Skipper == nil {
		config.Skipper = DefaultCSRFConfig.Skipper
	}
	if config.TokenLength == 0 {
		config.TokenLength = DefaultCSRFConfig.TokenLength
	}
	if config.TokenLookup == "" {
		config.TokenLookup = DefaultCSRFConfig.TokenLookup
	}
	if config.ContextKey == "" {
		config.ContextKey = DefaultCSRFConfig.ContextKey
	}
	if config.CookieName == "" {
		config.CookieName = DefaultCSRFConfig.CookieName
	}
	if config.CookieMaxAge == 0 {
		config.CookieMaxAge = DefaultCSRFConfig.CookieMaxAge
	}
	parts := strings.Split(config.TokenLookup, ":")
	extractor := csrfTokenFromHeader(parts[1])
	switch parts[0] {
	case "form":
		extractor = csrfTokenFromForm(parts[1])
	case "query":
		extractor = csrfTokenFromQuery(parts[1])
	}
	return func(next nio.HandlerFunc) nio.HandlerFunc {
		return func(c nio.Context) error {
			if config.Skipper(c) {
				return next(c)
			}
			req := c.Request()
			k, err := c.Cookie(config.CookieName)
			token := ""
			if err != nil {
				token = random.String(config.TokenLength)
			} else {
				token = k.Value
			}
			switch req.Method {
			case http.MethodGet, http.MethodHead, http.MethodOptions, http.MethodTrace:
			default:
				clientToken, err := extractor(c)
				if err != nil {
					return nio.NewHTTPError(http.StatusBadRequest, err.Error())
				}
				if !validateCSRFToken(token, clientToken) {
					return nio.NewHTTPError(http.StatusForbidden, "invalid csrf token")
				}
			}
			cookie := new(http.Cookie)
			cookie.Name = config.CookieName
			cookie.Value = token
			if config.CookiePath != "" {
				cookie.Path = config.CookiePath
			}
			if config.CookieDomain != "" {
				cookie.Domain = config.CookieDomain
			}
			cookie.Expires = time.Now().Add(time.Duration(config.CookieMaxAge) * time.Second)
			cookie.Secure = config.CookieSecure
			cookie.HttpOnly = config.CookieHTTPOnly
			c.SetCookie(cookie)
			c.Set(config.ContextKey, token)
			c.Response().Header().Add(nio.HeaderVary, nio.HeaderCookie)
			return next(c)
		}
	}
}
func csrfTokenFromHeader(header string) csrfTokenExtractor {
	return func(c nio.Context) (string, error) {
		return c.Request().Header.Get(header), nil
	}
}