Return empty string if token does not exist in request context

context.go

@@ -27,7 +27,10 @@ type csrfContext struct {
 // (that is, in another handler that wraps it,
 // or after the request has been served)
 func Token(req *http.Request) string {
-	ctx := req.Context().Value(nosurfKey).(*csrfContext)
+	ctx, ok := req.Context().Value(nosurfKey).(*csrfContext)
+	if !ok {
+		return ""
+	}
 
 	return ctx.token
 }

context_test.go

@@ -0,0 +1,14 @@
+package nosurf
+
+import (
+	"testing"
+)
+
+func TestTokenForRequestWithoutContext(t *testing.T) {
+	req := dummyGet()
+	token := Token(req)
+
+	if token != "" {
+		t.Errorf("Token should be %q but it's %v", "", token)
+	}
+}