nosurf [1] is a pretty popular CSRF protection package for Go. You need to realize that Go&#x27;s built in &quot;web framework&quot; is extremely minimal unlike Django. It&#x27;s more comparable to something like Flask, which also doesn&#x27;t have CSRF protection built-in.<p>[1] <a href="https:&#x2F;&#x2F;github.com&#x2F;justinas&#x2F;nosurf" rel="nofollow">https:&#x2F;&#x2F;github.com&#x2F;justinas&#x2F;nosurf</a>