Skip to content

fix: relax csrf to exclude path based apps #11430

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 12 commits into from
Jan 8, 2024
Merged

fix: relax csrf to exclude path based apps #11430

Changes from 1 commit
Commits
Show all changes
12 commits
Select commit Hold shift + click to select a range
658d7df
fix: relax csrf to exclude path based apps
Emyrk Jan 4, 2024
fe4e2ba
add unit test to verify path based apps are not CSRF blocked
Emyrk Jan 5, 2024
f2e615d
testing needs to be parallel
Emyrk Jan 5, 2024
a4bbc80
Linting
Emyrk Jan 5, 2024
63133cf
Merge remote-tracking branch 'origin/main' into stevenmasley/relax_csrf
Emyrk Jan 5, 2024
3828354
Merge remote-tracking branch 'origin/main' into stevenmasley/relax_csrf
Emyrk Jan 5, 2024
c6c4141
Try exempting first user
Emyrk Jan 5, 2024
42a3021
Merge remote-tracking branch 'origin/main' into stevenmasley/relax_csrf
Emyrk Jan 8, 2024
043c79d
we need to add csrf mw to set cookie
Emyrk Jan 8, 2024
388e56e
add comment
Emyrk Jan 8, 2024
fee870b
add unit tests
Emyrk Jan 8, 2024
6966f87
Linting
Emyrk Jan 8, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
Prev Previous commit
Linting
  • Loading branch information
@Emyrk
Emyrk committed Jan 8, 2024
commit 6966f87bb235dc921c1e8383a21238d0041110cb
3 changes: 2 additions & 1 deletion coderd/httpmw/csrf_test.go
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,6 +1,7 @@
package httpmw_test

import (
"context"
"net/http"
"testing"

Expand Down Expand Up @@ -59,7 +60,7 @@ func TestCSRFExemptList(t *testing.T) {
t.Run(c.Name, func(t *testing.T) {
t.Parallel()

r, err := http.NewRequest(http.MethodPost, c.URL, nil)
r, err := http.NewRequestWithContext(context.Background(), http.MethodPost, c.URL, nil)
require.NoError(t, err)

r.AddCookie(&http.Cookie{Name: codersdk.SessionTokenCookie, Value: "test"})
Expand Down