fix: reject cross-site requests to internal open-editor and invalidate endpoints

bjohansebas · bjohansebas · commit f4a545d2f5ff · 2026-07-01T15:07:53.000-05:00
diff --git a/.changeset/fix-cross-site-request-forgery.md b/.changeset/fix-cross-site-request-forgery.md
@@ -0,0 +1,5 @@
+---
+"webpack-dev-server": patch
+---
+
+Reject cross-site requests to the internal `open-editor` and `invalidate` endpoints. They performed state-changing actions (opening a file in the editor, forcing a recompilation) on any GET request, so a page the developer visited could trigger them. They now require a same-origin request, validated via `Sec-Fetch-Site` with an `Origin`/`Host` fallback.

-Original file line number
+Diff line change
@@ @@ -0,0 +1,5 @@ @@
 +---
 +"webpack-dev-server": patch
 +---
++
 +Reject cross-site requests to the internal `open-editor` and `invalidate` endpoints. They performed state-changing actions (opening a file in the editor, forcing a recompilation) on any GET request, so a page the developer visited could trigger them. They now require a same-origin request, validated via `Sec-Fetch-Site` with an `Origin`/`Host` fallback.