umputun / weblist

84%

master: 84%

LAST BUILD ON BRANCH feat/csrf-stdlib

branch: feat/csrf-stdlib

CHANGE BRANCH

x

Reset

Sync Branches

• feat/csrf-stdlib
• add-e2e-tests
• add-shell-completions
• ci/workflow-hardening
• csv-table-rendering
• dependabot/go_modules/github.com/go-jose/go-jose/v3-3.0.5
• dependabot/go_modules/golang.org/x/crypto-0.45.0
• feat/binary-content-detection
• feat/recursive-mtime
• feature-branding
• feature-params-restructure
• feature/add-direct-link-icon
• feature/extract-file-modal-template
• feature/file-preview
• feature/fix-linting-and-improve-error-handling
• feature/merge-file-templates
• feature/multi-file-download
• feature/refactor-file-handlers-clean
• feature/sftp-improvements
• feature/sort-cookies
• feature/syntax-highlighting
• file-upload
• fix-auth-rate-limiting-and-template-caching
• fix-responsive-design
• fix/ci-security-hardening
• fix/timing-attack-protection
• fix/upload-temp-dir
• json-api-feature
• markdown-rendering
• master
• paskal/dependabot-disable-updates
• redirect-directories
• refactor/simplify-assets-handler
• refs/tags/v0.1.0
• refs/tags/v0.1.1
• refs/tags/v0.1.2
• refs/tags/v0.1.3
• refs/tags/v0.1.4
• refs/tags/v0.1.5
• refs/tags/v0.10.3
• refs/tags/v0.11.0
• refs/tags/v0.12.0
• refs/tags/v0.12.1
• refs/tags/v0.13.0
• refs/tags/v0.13.1
• refs/tags/v0.13.2
• refs/tags/v0.14.0
• refs/tags/v0.14.1
• refs/tags/v0.14.2
• refs/tags/v0.14.3
• refs/tags/v0.14.4
• refs/tags/v0.15.0
• refs/tags/v0.16.0
• refs/tags/v0.17.0
• refs/tags/v0.17.1
• refs/tags/v0.17.2
• refs/tags/v0.17.3
• refs/tags/v0.18.0
• refs/tags/v0.18.1
• refs/tags/v0.19.0
• refs/tags/v0.19.1
• refs/tags/v0.19.2
• refs/tags/v0.2.1
• refs/tags/v0.2.2
• refs/tags/v0.2.3
• refs/tags/v0.2.4
• refs/tags/v0.20.0
• refs/tags/v0.20.1
• refs/tags/v0.3.0
• refs/tags/v0.3.1
• refs/tags/v0.4.0
• refs/tags/v0.4.1
• refs/tags/v0.4.2
• refs/tags/v0.5.0
• refs/tags/v0.5.1
• refs/tags/v0.6.0
• refs/tags/v0.7.0
• refs/tags/v0.8.0
• refs/tags/v0.8.1
• refs/tags/v0.8.2
• refs/tags/v0.8.3
• refs/tags/v0.8.4
• refs/tags/v0.8.5
• refs/tags/v0.9.0
• refs/tags/v0.9.1
• refs/tags/v0.9.2
• refs/tags/v0.9.3
• secure-auth-tokens
• security-enhancements
• style-improvements
• test/docker-fix

Build # 24542749925

Build Type

Pull #45

github

Committed by paskal

Commit Message

Replace hand-rolled CSRF tokens with http.CrossOriginProtection

Drop the per-request CSRF token cookie + hidden form field in favour
of Go 1.25's http.CrossOriginProtection middleware, which checks the
browser-set Sec-Fetch-Site header (with an Origin/Host fallback) and
needs no client-side instrumentation.

Net change: ~190 LoC removed.

Pull Request Pull Request #45: Replace hand-rolled CSRF tokens with http.CrossOriginProtection

Coverage Stats

4 of 4 new or added lines in 2 files covered. (100.0%)

2040 of 2437 relevant lines covered (83.71%)

22.86 hits per line