Movatterモバイル変換

[0]ホーム
URL:

Skip to content

Navigation Menu

Sign in
Appearance settings

Search code, repositories, users, issues, pull requests...

Provide feedback

We read every piece of feedback, and take your input very seriously.

Saved searches

Use saved searches to filter your results more quickly

 Sign up
Appearance settings

Replace CSRF cookie withCrossOriginProtection#36183

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to ourterms of service andprivacy statement. We’ll occasionally send you account related emails.

Already on GitHub?Sign in to your account

Merged
lafriks merged 17 commits intogo-gitea:mainfromsilverwind:nocsrf
Dec 25, 2025
Merged
Show file tree
Hide file tree
Changes from1 commit
Commits
Show all changes
17 commits
Select commitHold shift + click to select a range
98aa40c
Replace csrf cookie with Go 1.25 CrossOriginProtection
silverwindDec 17, 2025
78e333b
fix lint
silverwindDec 17, 2025
2ad6e00
remove CSRF_COOKIE_HTTP_ONLY docs
silverwindDec 17, 2025
85336f9
rename opt
silverwindDec 17, 2025
4b616c3
rename vars
silverwindDec 17, 2025
330dc75
rename var
silverwindDec 17, 2025
9378099
rename to optSignInNoCOP
silverwindDec 17, 2025
e76ffa9
fix some tests
silverwindDec 18, 2025
1eb058d
try to fix test
silverwindDec 18, 2025
a8a8958
fix
wxiaoguangDec 18, 2025
0fd754d
fix
wxiaoguangDec 18, 2025
8c5d861
fix
wxiaoguangDec 18, 2025
ce38887
fix data race
wxiaoguangDec 18, 2025
897ff51
fix AuthorizeLoginRedirect
wxiaoguangDec 18, 2025
2c26049
fine tune
wxiaoguangDec 25, 2025
4cabac4
Update services/context/context.go
wxiaoguangDec 25, 2025
0027ddf
Merge branch 'main' into nocsrf
wxiaoguangDec 25, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
PrevPrevious commit
NextNext commit
rename vars
  • Loading branch information
@silverwind
silverwind committedDec 17, 2025
commit4b616c3c2fb125efe55272c442482ddc99ca0075

Some comments aren't visible on the classic Files Changed page.

8 changes: 4 additions & 4 deletionsrouters/common/auth.go
View file
Open in desktop
Original file line numberDiff line numberDiff line change
Expand Up@@ -38,8 +38,8 @@ func AuthShared(ctx *context.Base, sessionStore auth_service.SessionStore, authM

// VerifyOptions contains required or check options
type VerifyOptions struct {
SignInRequired bool
SignOutRequired bool
AdminRequired bool
DisableCSRF bool
SignInRequiredbool
SignOutRequiredbool
AdminRequiredbool
DisableCrossOriginProtection bool
}
2 changes: 1 addition & 1 deletionrouters/web/githttp.go
View file
Open in desktop
Original file line numberDiff line numberDiff line change
Expand Up@@ -22,5 +22,5 @@ func addOwnerRepoGitHTTPRouters(m *web.Router) {
m.Methods("GET,OPTIONS", "/objects/{head:[0-9a-f]{2}}/{hash:[0-9a-f]{38,62}}", repo.GetLooseObject)
m.Methods("GET,OPTIONS", "/objects/pack/pack-{file:[0-9a-f]{40,64}}.pack", repo.GetPackFile)
m.Methods("GET,OPTIONS", "/objects/pack/pack-{file:[0-9a-f]{40,64}}.idx", repo.GetIdxFile)
},ignoreCSRF, repo.HTTPGitEnabledHandler, repo.CorsHandler(), context.UserAssignmentWeb())
},noCOP, repo.HTTPGitEnabledHandler, repo.CorsHandler(), context.UserAssignmentWeb())
}
12 changes: 6 additions & 6 deletionsrouters/web/web.go
View file
Open in desktop
Original file line numberDiff line numberDiff line change
Expand Up@@ -178,7 +178,7 @@ func verifyAuthWithOptions(options *common.VerifyOptions) func(ctx *context.Cont
return
}

if !options.SignOutRequired && !options.DisableCSRF {
if !options.SignOutRequired && !options.DisableCrossOriginProtection {
if err := crossOrginProtection.Check(ctx.Req); err != nil {
http.Error(ctx.Resp, err.Error(), http.StatusForbidden)
return
Expand DownExpand Up@@ -292,7 +292,7 @@ func Routes() *web.Router {
return routes
}

varignoreCSRF = verifyAuthWithOptions(&common.VerifyOptions{DisableCSRF: true})
varnoCOP = verifyAuthWithOptions(&common.VerifyOptions{DisableCrossOriginProtection: true})

// registerWebRoutes register routes
func registerWebRoutes(m *web.Router) {
Expand DownExpand Up@@ -489,7 +489,7 @@ func registerWebRoutes(m *web.Router) {
m.Post("/-/markup", reqSignIn, web.Bind(structs.MarkupOption{}), misc.Markup)

m.Get("/-/web-theme/list", misc.WebThemeList)
m.Post("/-/web-theme/apply",ignoreCSRF, misc.WebThemeApply)
m.Post("/-/web-theme/apply",noCOP, misc.WebThemeApply)

m.Group("/explore", func() {
m.Get("", func(ctx *context.Context) {
Expand DownExpand Up@@ -569,10 +569,10 @@ func registerWebRoutes(m *web.Router) {

m.Group("", func() {
m.Methods("GET, POST, OPTIONS", "/userinfo", auth.InfoOAuth)
m.Methods("POST, OPTIONS", "/access_token", web.Bind(forms.AccessTokenForm{}),ignoreCSRF, auth.AccessTokenOAuth)
m.Methods("POST, OPTIONS", "/access_token", web.Bind(forms.AccessTokenForm{}),noCOP, auth.AccessTokenOAuth)
m.Methods("GET, OPTIONS", "/keys", auth.OIDCKeys)
m.Methods("POST, OPTIONS", "/introspect", web.Bind(forms.IntrospectTokenForm{}), auth.IntrospectOAuth)
}, optionsCorsHandler(),ignoreCSRF)
}, optionsCorsHandler(),noCOP)
}, oauth2Enabled)

m.Group("/user/settings", func() {
Expand DownExpand Up@@ -1655,7 +1655,7 @@ func registerWebRoutes(m *web.Router) {
m.Post("/action/{action:accept_transfer|reject_transfer}", reqSignIn, repo.ActionTransfer)
}, optSignIn, context.RepoAssignment)

common.AddOwnerRepoGitLFSRoutes(m,ignoreCSRF, lfsServerEnabled) // "/{username}/{reponame}/{lfs-paths}": git-lfs support
common.AddOwnerRepoGitLFSRoutes(m,noCOP, lfsServerEnabled) // "/{username}/{reponame}/{lfs-paths}": git-lfs support

addOwnerRepoGitHTTPRouters(m) // "/{username}/{reponame}/{git-paths}": git http support

Expand Down
Loading
[8]ページ先頭
©2009-2026 Movatter.jp