Pull Request Overview

This PR fixes a CSRF vulnerability by adding authentication and CSRF header checks to OTA update endpoints across various examples.

• Enforces authentication on update routes
• Introduces CSRF header collection and validation in multiple files
• Applies similar security improvements in both WebUpdate and OTA updater code, as well as in the HTTPUpdateServer

Reviewed Changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated no comments.

          String origin = server.header(String(csrfHeaders[0]));

    String origin = server.header(String(csrfHeaders[0]));

          String origin = _server->header(String(csrfHeaders[0]));

This will work, but I'd suggest implementing this as a standard middleware implementation over this solution. That way the logic is reusable. But that's my ten cents. One concern around the use of theHost andOrigin header is that this won't work behind middleware proxies.

That concern is raised here:

Use the Host header value: If you want your application to find its own target so it doesn't have to be configured for each deployed instance, we recommend using the Host family of headers. The Host header is meant to contain the target origin of the request.But, if your app server is sitting behind a proxy, the Host header value is most likely changed by the proxy to the target origin of the URL behind the proxy, which is different than the original URL. This modified Host header origin won't match the source origin in the original Origin or Referer headers.

https://cheatsheetseries.owasp.org/cheatsheets/Cross-Site_Request_Forgery_Prevention_Cheat_Sheet.html?utm_source=chatgpt.com#identifying-the-target-origin

I've more frequently seen CSRF protection implemented via a CSRF token in the form post body, but this will likely also work.