Trusted Origins #116
Description
Hey.
I'm working on an application where the backend will be on one domain (using Golang and with this package to protect against CSRF) and the frontend implementation will be on another domain (or subdomain).
Thing is...I'm using HTTPS (because we're in 2019, right?) and this package has strict referer checking on the HTTPS case, which means that on my case the requests would be blocked even if the CSRF token is correct, just because the requests don't have the same referrer as the origin.
Describe the solution you'd like
The idea of this feature request is to add an option like Django's Trusted Origins, by defining a new option that receives a slice of strings that were matched against the referrer to check if it's valid or not according to the configuration.
Describe alternatives you've considered
The another option would be to create a middleware that wraps this package, changes the URL scheme to "http" and so this check just don't happen...but of course that's a VERY ugly solution and would not fix the problem...nor would protect decently against the security issue that check is trying to solve.