mirrors/TiddlyWiki5
1
0
Fork 0
mirror of https://github.com/Jermolene/TiddlyWiki5 synced 2026-09-19 08:10:44 +00:00
Code Issues Releases Wiki Activity

Add custom request header as CSRF mitigation

Browse Source 
By default we require the header X-Requested-With to be set to TiddlyWiki. Can be overriden by setting csrfdisable to "yes"

See https://www.owasp.org/index.php/Cross-Site_Request_Forgery_(CSRF)_Prevention_Cheat_Sheet#Protecting_REST_Services:_Use_of_Custom_Request_Headers
This commit is contained in:
Jermolene
2018-06-27 19:10:36 +01:00
parent cca73d0c85
commit 867488a25b
2 changed files with 11 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
core/modules/utils/dom/http.js
+3
View File
@@ -60,6 +60,9 @@ exports.httpRequest = function(options) {
if(data && !$tw.utils.hop(headers,"Content-type")) {
request.setRequestHeader("Content-type","application/x-www-form-urlencoded; charset=UTF-8");
}
if(!$tw.utils.hop(headers,"X-Requested-With")) {
request.setRequestHeader("X-Requested-With","TiddlyWiki");
}
try {
request.send(data);
} catch(e) {