Skip to content

[CSRF] Allow subdomains to match origin/referer headers #60707

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Open
Bilge opened this issue Jun 5, 2025 · 1 comment
Open

[CSRF] Allow subdomains to match origin/referer headers #60707

Bilge opened this issue Jun 5, 2025 · 1 comment
Labels
Security

Comments

@Bilge
Copy link
Contributor

Bilge commented Jun 5, 2025 •
edited
Loading

Description

The current logic of SameOriginCsrfTokenManager is that the hostname must be an exact match and this not configurable. Perhaps a whitelist of allowed domains, or just an option to allow subdomain matches of the same TLD would be useful.

Example

Requests from https://foo.steam250.com should also be allowed to https://bar.foo.steam250.com.
@Bilge Bilge changed the title [CSRF] Allow subdomains to match origin/refer headers [CSRF] Allow subdomains to match origin/referer headers Jun 5, 2025
@stof
Copy link
Member

stof commented Jun 6, 2025

Same-origin has a well defined meaning in web specifications. A different subdomain is not the same origin.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
Security
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
3 participants
@javiereguiluz @stof @Bilge