fix: add CSRF protection to API v1 routes (closes #112) #117
Reference in New Issue
Block a user
Delete Branch "fix/api-csrf-protection"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
Summary
Add CSRF protection to API v1 routes by requiring
X-Requested-Withheader on all state-changing requests (POST, PUT, DELETE). Browsers will not send custom headers in cross-origin simple requests, blocking CSRF attacks.Closes #112
Changes
APICSRFProtection()middleware requiringX-Requested-Withheader on non-GET/HEAD/OPTIONS requests/api/v1route groupX-Requested-Withto CORS allowed headerscsrf_test.go) and integration testsmake checkoutputPull request closed