956a06beb3
All checks were successful
Check / check (pull_request) Successful in 12m25s
Add APICSRFProtection middleware that requires X-Requested-With header on all state-changing (non-GET/HEAD/OPTIONS) API requests. This prevents CSRF attacks since browsers won't send custom headers in cross-origin simple requests (form posts, navigations). Changes: - Add APICSRFProtection() middleware in internal/middleware/middleware.go - Apply middleware to /api/v1 route group in routes.go - Add X-Requested-With to CORS allowed headers - Add unit tests for the middleware (csrf_test.go) - Add integration tests for CSRF rejection/allowance (api_test.go) - Update existing API tests to include the required header |
||
|---|---|---|
| .. | ||
| api_test.go | ||
| api.go | ||
| app_name_validation_test.go | ||
| app_name_validation.go | ||
| app.go | ||
| auth.go | ||
| dashboard.go | ||
| export_test.go | ||
| handlers_test.go | ||
| handlers.go | ||
| healthcheck.go | ||
| port_validation_test.go | ||
| render_template_test.go | ||
| repo_url_validation_test.go | ||
| repo_url_validation.go | ||
| sanitize_test.go | ||
| sanitize.go | ||
| setup.go | ||
| tail_validation_test.go | ||
| volume_validation_test.go | ||
| webhook.go | ||