CsrfCounterMeasure: skip Sec-Fetch-Site check for safe HTTP methods#391
Merged
Conversation
RFC 9110 defines GET, HEAD, OPTIONS, and TRACE as safe methods: they must not cause side effects, so they cannot be exploited for CSRF. Previously, `requestIsSafe()` checked the Sec-Fetch-Site header unconditionally, which caused it to return false (and throw "Rejecting cross-site request") when a cross-origin GET navigation reached a form. This broke legitimate flows where an external service redirects the browser back to a form. The redirect carries `Sec-Fetch-Site: cross-site`, and the form assembly failed before the page could render. For safe methods, `requestIsSafe()` now returns null, falling through to the token-based CSRF fallback. The token embedded in the rendered form still protects the subsequent POST submission: modern browsers send `Sec-Fetch-Site: same-origin` on that POST, and legacy browsers validate the token.
TheSyscall
force-pushed
the
csrf-allow-safe-request-methods
branch
from
e69a60b to
6cabeab
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
RFC 9110 defines GET, HEAD, OPTIONS, and TRACE as safe methods: they must not cause side effects, so they cannot be exploited for CSRF. Previously,
requestIsSafe()checked the Sec-Fetch-Site header unconditionally, which caused it to return false (and throw "Rejecting cross-site request") when a cross-origin GET navigation reached a form. This broke legitimate flows where an external service redirects the browser to a form. The redirect carriesSec-Fetch-Site: cross-site, and the form assembly failed before the page could render.For safe methods,
requestIsSafe()now returns null, falling through to the token-based CSRF fallback. The token embedded in the rendered form still protects the subsequent POST submission.