From e704d63cd63665845d544796e802134ea608e217 Mon Sep 17 00:00:00 2001 From: Julien Cretel Date: Mon, 16 Jun 2025 12:49:25 +0200 Subject: [PATCH] net/http: reduce allocs in CrossOriginProtection.Check Rather than repeatedly creating error values on CrossOriginProtection.Check's unhappy paths, return non-exported and effectively constant error variables. --- src/net/http/csrf.go | 11 ++++++++--- 1 file changed, 8 insertions(+), 3 deletions(-) diff --git a/src/net/http/csrf.go b/src/net/http/csrf.go index 8812a508ae..5e1b686fd1 100644 --- a/src/net/http/csrf.go +++ b/src/net/http/csrf.go @@ -136,7 +136,7 @@ func (c *CrossOriginProtection) Check(req *Request) error { if c.isRequestExempt(req) { return nil } - return errors.New("cross-origin request detected from Sec-Fetch-Site header") + return errCrossOriginRequest } origin := req.Header.Get("Origin") @@ -159,10 +159,15 @@ func (c *CrossOriginProtection) Check(req *Request) error { if c.isRequestExempt(req) { return nil } - return errors.New("cross-origin request detected, and/or browser is out of date: " + - "Sec-Fetch-Site is missing, and Origin does not match Host") + return errCrossOriginRequestFromOldBrowser } +var ( + errCrossOriginRequest = errors.New("cross-origin request detected from Sec-Fetch-Site header") + errCrossOriginRequestFromOldBrowser = errors.New("cross-origin request detected, and/or browser is out of date: " + + "Sec-Fetch-Site is missing, and Origin does not match Host") +) + // isRequestExempt checks the bypasses which require taking a lock, and should // be deferred until the last moment. func (c *CrossOriginProtection) isRequestExempt(req *Request) bool {