[issue2551024] REST interface doesn't respect anti-CSRF header X-REQUESTED-WITH
John Rouillard <[email protected]>
| Newsgroups | gmane.comp.bug-tracking.roundup.devel |
|---|---|
| Message-ID | <[email protected]> |
New submission from John Rouillard: As part of the integration of the REST interface, the X-REQUESTED-WITH http header should be checked for existence just like the xmlrpc interface. See the handle_xmlrpc function for the validation code and copy to handle_rest. Note that there is a pending patch to make processing of the X-REQUESTED-WITH header work under wsgi. Currently it is broken under WSGI. See issue2551023. ---------- components: Web interface messages: 6356 nosy: rouilj, schlatterbeck priority: normal severity: normal status: new title: REST interface doesn't respect anti-CSRF header X-REQUESTED-WITH type: behavior versions: devel _________________________________________________ Roundup tracker <[email protected]> <https://issues.roundup-tracker.org/issue2551024> _________________________________________________