Skip to content

fix: relax csrf to exclude path based apps #11430

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 12 commits into from
Jan 8, 2024
Merged

fix: relax csrf to exclude path based apps #11430

Changes from 1 commit
Commits
Show all changes
12 commits
Select commit Hold shift + click to select a range
658d7df
fix: relax csrf to exclude path based apps
Emyrk Jan 4, 2024
fe4e2ba
add unit test to verify path based apps are not CSRF blocked
Emyrk Jan 5, 2024
f2e615d
testing needs to be parallel
Emyrk Jan 5, 2024
a4bbc80
Linting
Emyrk Jan 5, 2024
63133cf
Merge remote-tracking branch 'origin/main' into stevenmasley/relax_csrf
Emyrk Jan 5, 2024
3828354
Merge remote-tracking branch 'origin/main' into stevenmasley/relax_csrf
Emyrk Jan 5, 2024
c6c4141
Try exempting first user
Emyrk Jan 5, 2024
42a3021
Merge remote-tracking branch 'origin/main' into stevenmasley/relax_csrf
Emyrk Jan 8, 2024
043c79d
we need to add csrf mw to set cookie
Emyrk Jan 8, 2024
388e56e
add comment
Emyrk Jan 8, 2024
fee870b
add unit tests
Emyrk Jan 8, 2024
6966f87
Linting
Emyrk Jan 8, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
Prev Previous commit
Next Next commit
add comment
  • Loading branch information
@Emyrk
Emyrk committed Jan 8, 2024
commit 388e56e5856fe1a7c7557b5dea5e5bc0fca8b8e7
1 change: 1 addition & 0 deletions coderd/httpmw/csrf.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -45,6 +45,7 @@ func CSRF(secureCookie bool) func(next http.Handler) http.Handler {
mw.ExemptRegexp(regexp.MustCompile("/organizations/[^/]+/provisionerdaemons/*"))

mw.ExemptFunc(func(r *http.Request) bool {
// Only enforce CSRF on API routes.
if !strings.HasPrefix(r.URL.Path, "/api") {
return true
}
Expand Down