Golang表单防重与验证技巧

// 生成 token
token := uuid.New().String()
session, _ := sessionStore.Get(r, "form")
session.Values["token"] = token
session.Save(r, w)

// 表单中
<input type="hidden" name="csrf_token" value="{{.Token}}">

// 提交处理
submittedToken := r.FormValue("csrf_token")
if sessionToken, ok := session.Values["token"]; !ok || sessionToken != submittedToken {
    http.Error(w, "无效或已过期的请求", http.StatusBadRequest)
    return
}
// 校验通过后清除 token
delete(session.Values, "token")
session.Save(r, w)

type LoginForm struct {
    Username string `form:"username" validate:"required,min=3,max=32"`
    Password string `form:"password" validate:"required,min=6"`
}

// 绑定并验证
var form LoginForm
if err := r.ParseForm(); err != nil {
    http.Error(w, "表单解析失败", http.StatusBadRequest)
    return
}
decoder := form.NewDecoder()
if err := decoder.Decode(&form, r.PostForm); err != nil {
    http.Error(w, "参数错误", http.StatusBadRequest)
    return
}
validate := validator.New()
if err := validate.Struct(form); err != nil {
    http.Error(w, "验证失败: "+err.Error(), http.StatusBadRequest)
    return
}