apunkt/SurfSense
1
0
Fork 0
mirror of https://github.com/MODSetter/SurfSense.git synced 2026-07-20 23:21:06 +02:00
Code Issues Projects Releases Packages Wiki Activity

Merge pull request #1607 from Benebo7/fix/csrf-selfhosted-sameorigin

Browse source 
fix: add same origin check on csrf middleware
This commit is contained in:
Rohan Verma 2026-07-15 16:31:00 -07:00 • committed by GitHub
commit 2de275f597
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
1 changed files with 14 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

14
surfsense_backend/app/auth/csrf.py
View file

@ -32,6 +32,15 @@ def _allowed_origins() -> set[str]:
return origins
# Lets self-hosted deployments work from any address (LAN IP, custom domain)
# without pre-configuring the static allowlist on .env.
def _is_same_origin(origin: str | None, host: str | None) -> bool:
if not origin or not host:
return False
parsed_origin = urlparse(origin)
return parsed_origin.netloc == host
class CsrfOriginMiddleware(BaseHTTPMiddleware):
async def dispatch(
self,
@ -52,6 +61,11 @@ class CsrfOriginMiddleware(BaseHTTPMiddleware):
origin = request.headers.get("Origin") or _origin_from_url(
request.headers.get("Referer")
)
host = request.headers.get("Host")
if _is_same_origin(origin, host):
return await call_next(request)
if origin not in _allowed_origins():
return JSONResponse(
{"detail": "CSRF origin check failed"},