Add custom request header as CSRF mitigation

By default we require the header X-Requested-With to be set to TiddlyWiki. Can be overriden by setting csrfdisable to "yes"

See https://www.owasp.org/index.php/Cross-Site_Request_Forgery_(CSRF)_Prevention_Cheat_Sheet#Protecting_REST_Services:_Use_of_Custom_Request_Headers

core/modules/server/server.js

@@ -42,6 +42,8 @@ function Server(options) {
 		}		
 	}
 	$tw.utils.extend({},this.defaultVariables,options.variables);
+	// Initialise CSRF
+	this.csrfDisable = this.get("csrfdisable") === "yes";
 	// Initialise authorization
 	var authorizedUserName = (this.get("username") && this.get("password")) ? this.get("username") : "(anon)";
 	this.authorizationPrincipals = {
@@ -143,6 +145,12 @@ Server.prototype.requestHandler = function(request,response) {
 	state.urlInfo = url.parse(request.url);
 	// Get the principals authorized to access this resource
 	var authorizationType = this.methodMappings[request.method] || "readers";
+	// Check for the CSRF header if this is a write
+	if(!this.csrfDisable && authorizationType === "writers" && request.headers["x-requested-with"] !== "TiddlyWiki") {
+		response.writeHead(403,"'X-Requested-With' header required to login to '" + this.servername + "'");
+		response.end();
+		return;		
+	}
 	// Check whether anonymous access is enabled
 	if(!this.isAuthorized(authorizationType,null)) {
 		// Complain if there are no active authenticators

core/modules/utils/dom/http.js

@@ -60,6 +60,9 @@ exports.httpRequest = function(options) {
 	if(data && !$tw.utils.hop(headers,"Content-type")) {
 		request.setRequestHeader("Content-type","application/x-www-form-urlencoded; charset=UTF-8");
 	}
+	if(!$tw.utils.hop(headers,"X-Requested-With")) {
+		request.setRequestHeader("X-Requested-With","TiddlyWiki");
+	}
 	try {
 		request.send(data);
 	} catch(e) {