[serendipity-cvs] [s9y/Serendipity] 6a6dd9: Check on Sec-Fetch-Site header instead of a token ...

  Branch: refs/heads/master
  Home:   https://github.com/s9y/Serendipity
  Commit: 6a6dd9c01f35b661d848cd5e16d9ee3e5a660620
      https://github.com/s9y/Serendipity/commit/6a6dd9c01f35b661d848cd5e16d9ee3e5a660620
  Author: onli <[email protected]>
  Date:   2026-03-23 (Mon, 23 Mar 2026)

  Changed paths:
    M docs/NEWS
    M include/functions_config.inc.php
    M serendipity_admin.php

  Log Message:
  -----------
  Check on Sec-Fetch-Site header instead of a token for CSRF attacks (#947)

* Check on Sec-Fetch-Site header instead of a token for CSRF attacks
Serendipity used to add a randomly generated token to forms and link buttons to secure against CSRF attacks, where other sites direct the user with forged forms to do hostile actions in their own backend. That token was checked, so forged forms could be discarded.

This approach is an alternative: Modern browsers set the Sec-Fetch-Site header with a vlaue that showswhere the request is coming form. By enforcing the 'same-origin' value, we get the same protection of knowing that requests originate from our own site. This also makes attacks from forms on foreign sites impossible. And gives the advantage of not having to implement custom timeouts. See https://github.com/s9y/Serendipity/issues/945

* document changes

* Make sec-fetch-site header required
Adress security concerns

* Remove unused constant XSRF_KEY

* Fix: Directly entering backend URLs caused csrf error

* Add fallback to ORIGIN if SEC_FETCH_SITE is missing
Safari only knows of SET_FETCH-SITe since 2023, so legitimate usage of browsers without that header is possible. This way those users will not be logged out.



To unsubscribe from these emails, change your notification settings at https://github.com/s9y/Serendipity/settings/notifications