paskal / newscope / 24543343923

81%

master: 81%

push

github

wrap router with http.crossoriginprotection for csrf defence

bumps go to 1.25 to pick up http.newcrossoriginprotection. the
middleware checks sec-fetch-site (forbidden header set by all major
browsers since 2023) with an origin/host fallback and rejects
cross-origin state-changing requests at the http layer.

ci and release workflows updated to go 1.25 to match go.mod.

1 of 1 new or added line in 1 file covered. (100.0%)

3722 of 4596 relevant lines covered (80.98%)

27.93 hits per line