dries/ocman
1
0
Fork 1
Code Issues 38 Pull requests 4 Projects Releases 122 Packages Wiki Activity Actions 1

fix: reject cross-site POSTs when auth is disabled #420

Merged
dries merged 2 commits from fix/410-csrf-guard into main 2026-07-21 18:01:24 +02:00
Conversation 1 Commits 2 Files changed 5 +97 -15
dries commented 2026-07-21 12:13:36 +02:00
Owner
Copy link

Summary

  • apply Origin and Sec-Fetch-Site validation to all authenticated POST routes
  • preserve Origin-less local CLI access
  • add regression coverage for auth-disabled cross-site requests

Closes #410

Testing

  • go test ./...
  • go vet ./...
## Summary - apply Origin and Sec-Fetch-Site validation to all authenticated POST routes - preserve Origin-less local CLI access - add regression coverage for auth-disabled cross-site requests Closes #410 ## Testing - go test ./... - go vet ./...
fix: reject cross-site POSTs when auth is disabled
All checks were successful
CI / Build Desktop (macOS arm64) (pull_request) Successful in 1m37s
Details
CI / Frontend (pull_request) Successful in 6m37s
Details
CI / Backend (pull_request) Successful in 8m25s
Details
CI / Coverage Results (pull_request) Successful in 22s
Details
CI / Build (pull_request) Successful in 4m30s
Details
CI / Playwright E2E (pull_request) Successful in 8m19s
Details
CI / Semantic Tag (pull_request) Successful in 5s
Details
cb10524a9f 
Factor the browser-origin check out of isPrivilegedRequest into a
csrfSafe guard and compose it into s.post, so every mutating route
gets Origin / Sec-Fetch-Site validation regardless of auth config.
Origin-less CLI clients are unaffected. Closes #410.
forgejo-actions commented 2026-07-21 12:23:19 +02:00
Copy link

Coverage ratchet: ✅ pass

Suite Baseline This PR Δ
frontend 66.41% 66.38% -0.03 ✅
go 77.60% 77.70% +0.10 ✅

Tolerance: -0.1%. Baseline stored on gh-pages.

<!-- coverage-ratchet --> ### Coverage ratchet: ✅ pass | Suite | Baseline | This PR | Δ | | |---|---|---|---|---| | frontend | 66.41% | 66.38% | -0.03 | ✅ | | go | 77.60% | 77.70% | +0.10 | ✅ | _Tolerance: -0.1%. Baseline stored on `gh-pages`._
fix: guard mixed-method routes from CSRF
All checks were successful
CI / Build Desktop (macOS arm64) (pull_request) Successful in 1m29s
Details
CI / Frontend (pull_request) Successful in 7m3s
Details
CI / Backend (pull_request) Successful in 7m49s
Details
CI / Coverage Results (pull_request) Successful in 28s
Details
CI / Build (pull_request) Successful in 4m4s
Details
CI / Playwright E2E (pull_request) Successful in 7m51s
Details
CI / Semantic Tag (pull_request) Successful in 5s
Details
92493f5279
dries merged commit 58b379d0cd into main 2026-07-21 18:01:24 +02:00
Sign in to join this conversation.
Reviewers
No reviewers
Labels
Clear labels   
backend

Go backend code

  
bug

Something is broken or incorrect

  
chore

Maintenance, tooling, or cleanup

  
duplication

Code duplication to be addressed

  
effort:complex

Significant effort or risk

  
effort:medium

Moderate effort required

  
effort:trivial

Quick fix, low complexity

  
enhancement

New feature or capability

  
follow-up

Follow-up from a PR review or shipped change

  
frontend

TypeScript / React frontend code

  
fullstack

Touches both backend and frontend

  
priority:high

Should be addressed soon

  
ready-for-agent

Agent-grabbable ticket, fully specced

  
refactor

Code restructuring without behaviour change

  
security

Security related

No labels
backend
bug
chore
duplication
effort:complex
effort:medium
effort:trivial
enhancement
follow-up
frontend
fullstack
priority:high
ready-for-agent
refactor
security
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
2 participants
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference
dries/ocman!420
No description provided.