melosh/mal
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix(csrf): handle X-Forwarded-Host and parse origin as URL

Browse Source
This commit is contained in:
mkelvers
2026-04-22 10:48:52 +02:00
parent 9c9a692925
commit e4cff38773
1 changed files with 11 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files

14
pkg/middleware/csrf.go
View File

@@ -16,7 +16,6 @@ func VerifyOrigin(next http.Handler) http.Handler {
if origin == "" { if origin == "" {
referer := r.Header.Get("Referer") referer := r.Header.Get("Referer")
if referer == "" { if referer == "" {
// If neither is present, and it's a POST/PUT/DELETE, reject it (strict policy)
http.Error(w, "Missing Origin or Referer header", http.StatusForbidden) http.Error(w, "Missing Origin or Referer header", http.StatusForbidden)
return return
} }
@@ -29,12 +28,21 @@ func VerifyOrigin(next http.Handler) http.Handler {
origin = refURL.Scheme + "://" + refURL.Host origin = refURL.Scheme + "://" + refURL.Host
} }
originURL, err := url.Parse(origin)
if err != nil {
http.Error(w, "Invalid Origin header", http.StatusForbidden)
return
}
host := r.Host host := r.Host
// If origin doesn't match host (accounting for potential schema prefixes) if forwardedHost := r.Header.Get("X-Forwarded-Host"); forwardedHost != "" {
host = forwardedHost
}
expectedHTTP := "http://" + host expectedHTTP := "http://" + host
expectedHTTPS := "https://" + host expectedHTTPS := "https://" + host
if origin != expectedHTTP && origin != expectedHTTPS { if originURL.Scheme+"://"+originURL.Host != expectedHTTP && originURL.Scheme+"://"+originURL.Host != expectedHTTPS {
http.Error(w, "Cross-Site Request Forgery (CSRF) origin mismatch", http.StatusForbidden) http.Error(w, "Cross-Site Request Forgery (CSRF) origin mismatch", http.StatusForbidden)
return return
} }