search

PurpleI2P / i2pd

🛡 I2P: End-to-End encrypted and anonymous Internet
https://i2pd.website
BSD 3-Clause "New" or "Revised" License
3.28k stars 424 forks source link

add CSRF tokens and CORS to webui #706

Closed majestrate closed 7 years ago

l-n-s commented 7 years ago

@orignal added CSRF tokens in https://github.com/PurpleI2P/i2pd/commit/10d6cd989608d85dd80ec19433ca66f817a73bbf

There needs to be CORS and protection from clickjacking?

For click-jacking protection, HTTPServer needs to always send header X-Frame-Options: SAMEORIGIN

https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/X-Frame-Options