Restricting CSRF to specific route groups

[glennbach]

Given this:

csrf_middleware := middleware.CSRFWithConfig(
		middleware.CSRFConfig{
			TokenLength:    32,
			TokenLookup:    "header:X-CSRF-Token",
			CookieName:     "csrf_token",
			CookiePath:     "/",
			CookieHTTPOnly: false,
			CookieSecure:   true,
			CookieSameSite: http.SameSiteNoneMode,
		},
	)

If I add this to all routes:

e.Use(csrf_middleware)

It works. But, if instead I just add it to a specific group:

billing_group := e.Group("/billing",
		middleware.StaticWithConfig(
			middleware.StaticConfig{
				Root:  settings.GetString("frontend_dir"),
				Index: "index.html",
				HTML5: true,
			},
		),
       csrf_middleware,
	)

or

billing_group := e.Group("/billing",
		middleware.StaticWithConfig(
			middleware.StaticConfig{
				Root:  settings.GetString("frontend_dir"),
				Index: "index.html",
				HTML5: true,
			},
		),
	)
billing_group.Use(csrf_middleware)

it doesn't work, ie. it doesn't validate the csrf. Any obvious mistake here? Suggestions?

Thanks

[glennbach]

worked in another place.