external auth is just get requests

Emyrk · Emyrk · commit 7760ff19e165 · 2023-12-19T14:55:19.000-06:00
diff --git a/coderd/httpmw/csrf.go b/coderd/httpmw/csrf.go
@@ -20,7 +20,7 @@ func CSRF(secureCookie bool) func(next http.Handler) http.Handler {
 			http.Error(w, "Something is wrong with your CSRF token. Please refresh the page. If this error persists, try clearing your cookies.", http.StatusBadRequest)
 		}))
 		// Exempt all requests that do not require CSRF protection.
-		// All GET requests are exempt by default and no not need to be added here.
+		// All GET requests are exempt by default.
 		mw.ExemptPath("/api/v2/csp/reports")
 
 		// Top level agent routes.
@@ -29,9 +29,6 @@ func CSRF(secureCookie bool) func(next http.Handler) http.Handler {
 		mw.ExemptRegexp(regexp.MustCompile("api/v2/workspaceagents/me/*"))
 		// Derp routes
 		mw.ExemptRegexp(regexp.MustCompile("derp/*"))
-		// Some extra non-auth
-		mw.ExemptRegexp(regexp.MustCompile("/externa-auth/*"))
-		mw.ExemptRegexp(regexp.MustCompile("/github/*"))
 
 		mw.ExemptFunc(func(r *http.Request) bool {
 			// CSRF only affects requests that automatically attach credentials via a cookie.
