issues/158/examples for working api with javascript frontend

[francoposa]

Fixes #158, which is essentially that

1. none of the examples in the README for working with a JavaScript frontend will work without proper CORS config on the backend
2. there is no example at all for using the HTTP header instead of getting the CSRF token from the hidden form field

Summary of Changes

I have merged/copied over these simplified examples from my own repository of working examples.

I was not sure how the maintainers may want to reference these examples in the main README. Copying them over to the README verbatim would be putting a lot of code into the README, but without changing the current README, the content there differs significantly from the examples.

[francoposa]

@DavidLarsKetch do you have any input on how to approach the README?

[coreydaley]

Would you mind updating your example to use go1.20 and update the dependencies in your go.mod? Then I think we can get this merged.

[codecov[bot]]

Codecov Report

Merging #162 (226480b) into main (a71a12f) will not change coverage. Report is 1 commits behind head on main. The diff coverage is n/a.

@@           Coverage Diff           @@
##             main     #162   +/-   ##
=======================================
  Coverage   90.93%   90.93%           
=======================================
  Files           5        5           
  Lines         353      353           
=======================================
  Hits          321      321           
  Misses         25       25           
  Partials        7        7           

[canrozanes]

Hi @francoposa

none of the examples in the README for working with a JavaScript frontend will work without proper CORS config on the backend

Could you point me to a resource about this? Is CORS a pre-requisite for CSRF protection? If I setup gorilla/csrf on my SPA without CORS, will my site still be vulnerable to CSRF?