efa8f51310
All checks were successful
Check / check (pull_request) Successful in 11m36s
- Add APICSRFProtection middleware requiring X-Requested-With header on state-changing API requests (POST, PUT, DELETE, PATCH) - Apply middleware to all /api/v1 routes - Upgrade session cookie SameSite from Lax to Strict (defense-in-depth) - Add X-Requested-With to CORS allowed headers - Add tests for the new middleware Browsers cannot send custom headers cross-origin without CORS preflight, which effectively blocks CSRF attacks via cookie-based session auth. |
||
|---|---|---|
| .. | ||
| config | ||
| database | ||
| docker | ||
| globals | ||
| handlers | ||
| healthcheck | ||
| logger | ||
| middleware | ||
| models | ||
| server | ||
| service | ||
| ssh | ||