apunkt/SurfSense
1
0
Fork 0
mirror of https://github.com/MODSetter/SurfSense.git synced 2026-07-20 23:21:06 +02:00
Code Issues Projects Releases Packages Wiki Activity

fix: add same origin check on csrf middleware

Browse source
This commit is contained in:
Benebo7 2026-07-15 16:25:31 -03:00
parent 2b018c4474
commit 67a8d50d6f
1 changed files with 14 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

14
surfsense_backend/app/auth/csrf.py
View file

@ -32,6 +32,15 @@ def _allowed_origins() -> set[str]:
return origins return origins
# Lets self-hosted deployments work from any address (LAN IP, custom domain)
# without pre-configuring the static allowlist on .env.
def _is_same_origin(origin: str | None, host: str | None) -> bool:
if not origin or not host:
return False
parsed_origin = urlparse(origin)
return parsed_origin.netloc == host
class CsrfOriginMiddleware(BaseHTTPMiddleware): class CsrfOriginMiddleware(BaseHTTPMiddleware):
async def dispatch( async def dispatch(
self, self,
@ -52,6 +61,11 @@ class CsrfOriginMiddleware(BaseHTTPMiddleware):
origin = request.headers.get("Origin") or _origin_from_url( origin = request.headers.get("Origin") or _origin_from_url(
request.headers.get("Referer") request.headers.get("Referer")
) )
host = request.headers.get("Host")
if _is_same_origin(origin, host):
return await call_next(request)
if origin not in _allowed_origins(): if origin not in _allowed_origins():
return JSONResponse( return JSONResponse(
{"detail": "CSRF origin check failed"}, {"detail": "CSRF origin check failed"},