Buriburizaemon/nezha_domains
1
0
Fork 0
mirror of https://github.com/Buriburizaem0n/nezha_domains.git synced 2026-09-19 09:40:12 +00:00
Code Issues Packages Projects Releases Wiki Activity

fix(csrf): set Secure on csrf cookie only over HTTPS

Browse Source 
CodeQL go/cookie-secure-not-set (CWE-614) flagged the nz-csrf cookie as
missing the Secure attribute. Mirror writeOauth2StateCookie and derive
Secure from the request scheme instead of hardcoding it: forcing
Secure=true would make browsers drop the cookie on plain-HTTP intranet
deployments, breaking the double-submit CSRF pair and 403-ing every
unsafe request.
This commit is contained in:
naiba
2026-06-05 01:08:00 +00:00
parent 806036d75b
commit 78f5b014ee
1 changed files with 6 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
cmd/dashboard/controller/csrf.go
+6 -1
View File
@@ -72,8 +72,13 @@ func setCSRFCookie(c *gin.Context) {
if token == "" {
return
}
// Secure is set only when the request arrives over HTTPS, mirroring
// writeOauth2StateCookie. On plain HTTP (e.g. intranet deployments) a
// Secure cookie would be dropped by the browser, breaking the
// double-submit pair, so we must not force it unconditionally.
secure := c.Request.URL.Scheme == "https" || c.Request.TLS != nil
c.SetSameSite(http.SameSiteStrictMode)
c.SetCookie(csrfCookieName, token, 0, "/", "", false, false)
c.SetCookie(csrfCookieName, token, 0, "/", "", secure, false)
}
const (