google / go-safeweb

Secure-by-default HTTP servers in Go.
Apache License 2.0
1.43k stars 81 forks source link

xsrfhtml: relax action check to host. #286

Closed empijei closed 3 years ago

empijei commented 3 years ago

Currently we validate CSRF tokens based on paths, but this makes writing applications very hard.

For example a "logout" button cannot post to a "/logout" endpoint from a "/profile" page or it will be blocked.

This protection mechanism is aimed at protecting from cross-site forgery anyways, not cross-path forgery.