solidjs / solid / 33304808057

72%

main: 89%

push

github

feat(web): name the GET read contract, add protectDeclaredReads (#3114)

The origin gate is skipped for GET-declared reads by design — same-origin
policy already keeps a cross-site caller from READING the response, and
the gate's Vary fragments the shared-cache entries the helper exists to
enable — but the premise the skip rests on lived nowhere: GET() did not
document it and nothing offered an alternative for deployments that do
not want the trade.

Declaring GET is now documented on both entries as the safety assertion
it is (the function becomes executable from any origin, with
caller-chosen arguments, carrying the user's ambient cookies — declare
only reads that are safe in the RFC 9110 section 9.2.1 sense), and
csrf.protectDeclaredReads opts a deployment's reads into the origin gate
when shared caches are not in play. Tests pin both halves: the default
skip, so nobody "fixes" it into cache poisoning, and the opt-in gate.

Co-authored-by: Cursor <cursoragent@cursor.com>

517 of 789 branches covered (65.53%)

Branch coverage included in aggregate %.

767 of 1003 relevant lines covered (76.47%)

14.54 hits per line