[serendipity-cvs] [s9y/Serendipity] 7b59b6: Check on Sec-Fetch-Site header instead of a token ...

  Branch: refs/heads/feature/headerCSRFProtection
  Home:   https://github.com/s9y/Serendipity
  Commit: 7b59b6fe6d72f7e0c1c4cf58d20620defa22327a
      https://github.com/s9y/Serendipity/commit/7b59b6fe6d72f7e0c1c4cf58d20620defa22327a
  Author: onli <[email protected]>
  Date:   2026-01-04 (Sun, 04 Jan 2026)

  Changed paths:
    M include/functions_config.inc.php
    M serendipity_admin.php

  Log Message:
  -----------
  Check on Sec-Fetch-Site header instead of a token for CSRF attacks
Serendipity used to add a randomly generated token to forms and link buttons to secure against CSRF attacks, where other sites direct the user with forged forms to do hostile actions in their own backend. That token was checked, so forged forms could be discarded.

This approach is an alternative: Modern browsers set the Sec-Fetch-Site header with a vlaue that showswhere the request is coming form. By enforcing the 'same-origin' value, we get the same protection of knowing that requests originate from our own site. This also makes attacks from forms on foreign sites impossible. And gives the advantage of not having to implement custom timeouts. See https://github.com/s9y/Serendipity/issues/945



To unsubscribe from these emails, change your notification settings at https://github.com/s9y/Serendipity/settings/notifications