umputun / newscope / 32345648948

81%

master: 81%

Pull #40

github

Wrap router with http.CrossOriginProtection for CSRF defence

Newscope has no CSRF protection: every state-changing endpoint under
/api/v1 accepts a cross-site form post, and the UI runs without tokens.
Go 1.25 ships http.CrossOriginProtection, which rejects unsafe methods
whose Sec-Fetch-Site or Origin marks them as cross-origin, and leaves
GET, HEAD and header-less requests from non-browser clients alone, so
RSS readers and API clients keep working.

The middleware runs directly after the throttle, ahead of rest.SizeLimit,
which reads the whole body into memory before passing the request on.

Using it raises the minimum go version to 1.25, matched in go.mod, both
workflows, CONTRIBUTING.md and CLAUDE.md.

2 of 2 new or added lines in 1 file covered. (100.0%)

3719 of 4597 relevant lines covered (80.9%)

27.93 hits per line