Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

feat: Include CSRF protected index.php routes #181

Merged
merged 1 commit into from
Nov 11, 2024
Merged

feat: Include CSRF protected index.php routes #181

merged 1 commit into from
Nov 11, 2024

Conversation

provokateurin
Copy link
Member

Closes #179
Due to nextcloud/server#46760 index.php routes can now also use the OCS-APIRequest header to pass the CSRF protections.

@provokateurin provokateurin added the enhancement New feature or request label Nov 11, 2024
@nickvergessen
Copy link
Member

OCS header on non-OCS endpoints sounds illegal 🙈

@provokateurin
Copy link
Member Author

It's an established header, but yeah.
To be fair the whole header is a bit wrong, since one should use the X- prefix for custom headers which don't do either.

@provokateurin provokateurin mentioned this pull request Nov 11, 2024
Merged
nickvergessen
nickvergessen approved these changes Nov 11, 2024
View reviewed changes
Copy link
Member

@nickvergessen nickvergessen left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Not a fan

@provokateurin provokateurin merged commit b8b55cc into main Nov 11, 2024
8 of 14 checks passed
@provokateurin provokateurin deleted the feat/csrf-protected-index-php-routes branch November 11, 2024 14:31
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@nickvergessen nickvergessen nickvergessen approved these changes

@come-nc come-nc Awaiting requested review from come-nc

Assignees
No one assigned
Labels
enhancement New feature or request
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.

Include non-OCS routes with CSRF protection
2 participants
@provokateurin @nickvergessen