server

mirror of https://github.com/gotify/server.git synced 2026-09-06 15:57:32 +08:00

Files

Jannis Mattheis d832b1a41d fix: prevent csrf for cookie requests

Prevously, the token was passed as X-Gotify-Key by the UI, so there was
no csrf because no cookie was added by the browser to the request.

The cookie is saved by SameSite=strict, this provides some protection
against csrf. But an subdomain takeover could still allow for csrf. E.g.
evil.gotify.net could send authenticated requests to gotify.net.

This uses the go builtin cross origin protection, listed on the owasp
page: https://cheatsheetseries.owasp.org/cheatsheets/Cross-Site_Request_Forgery_Prevention_Cheat_Sheet.html#built-in-or-existing-csrf-implementations

2026-07-17 14:09:48 +02:00

password

test: don't run tests twice

2023-09-17 09:05:15 +02:00

authentication_test.go

fix: prevent csrf for cookie requests

2026-07-17 14:09:48 +02:00

authentication.go

fix: prevent csrf for cookie requests

2026-07-17 14:09:48 +02:00

cookie.go

fix: make secure cookie configurable