From 67a8d50d6f58b91cbeb854ef861b9ae159b97c97 Mon Sep 17 00:00:00 2001 From: Benebo7 Date: Wed, 15 Jul 2026 16:25:31 -0300 Subject: [PATCH] fix: add same origin check on csrf middleware --- surfsense_backend/app/auth/csrf.py | 14 ++++++++++++++ 1 file changed, 14 insertions(+) diff --git a/surfsense_backend/app/auth/csrf.py b/surfsense_backend/app/auth/csrf.py index 4f1b6db4a..793a5e863 100644 --- a/surfsense_backend/app/auth/csrf.py +++ b/surfsense_backend/app/auth/csrf.py @@ -32,6 +32,15 @@ def _allowed_origins() -> set[str]: return origins +# Lets self-hosted deployments work from any address (LAN IP, custom domain) +# without pre-configuring the static allowlist on .env. +def _is_same_origin(origin: str | None, host: str | None) -> bool: + if not origin or not host: + return False + parsed_origin = urlparse(origin) + return parsed_origin.netloc == host + + class CsrfOriginMiddleware(BaseHTTPMiddleware): async def dispatch( self, @@ -52,6 +61,11 @@ class CsrfOriginMiddleware(BaseHTTPMiddleware): origin = request.headers.get("Origin") or _origin_from_url( request.headers.get("Referer") ) + host = request.headers.get("Host") + + if _is_same_origin(origin, host): + return await call_next(request) + if origin not in _allowed_origins(): return JSONResponse( {"detail": "CSRF origin check failed"},