umputun / newscope / 34170417671

81%

push

github

Wrap router with http.CrossOriginProtection for CSRF defence (#40)

Newscope has no CSRF protection: every state-changing endpoint under
/api/v1 accepts a cross-site form post, and the UI runs without tokens.
http.CrossOriginProtection rejects unsafe methods whose Sec-Fetch-Site or
Origin marks them as cross-origin, and leaves GET, HEAD and header-less
requests from non-browser clients alone, so RSS readers and API clients
keep working.

The middleware runs directly after the throttle, ahead of rest.SizeLimit,
which reads the whole body into memory before passing the request on.

2 of 2 new or added lines in 1 file covered. (100.0%)

3750 of 4620 relevant lines covered (81.17%)

27.95 hits per line