fix(graphiql): use origin check to bypass CSRF

graphile / starter

Opinionated SaaS quick-start with pre-built user account and organization system for full-stack application development in React, Node.js, GraphQL and PostgreSQL. Powered by PostGraphile, TypeScript, Apollo Client, Graphile Worker, Graphile Migrate, GraphQL Code Generator, Ant Design and Next.js

https://graphile-starter.herokuapp.com

Other

1.75k stars 220 forks source link

fix(graphiql): use origin check to bypass CSRF #233

Closed benjie closed 3 years ago

benjie commented 3 years ago

Description

In latest Chrome the Referer header is no longer being sent from GraphiQL. However, it is sufficient to check the Origin header for CSRF protection so we can skip the CSRF middleware if the Origin header matches.

Performance impact

Negligible.

Security impact

Warrants checking, but believed to be safe.