Skip to main content

Public

Project privacy set to public. By default, its content is available to everyone (authenticated or not). Please note that more restrictive permissions might exist on some items.

    •  
      request #42977 Harden CSRF protection by blocking all cross-site state modifying queries to the Web UI
    Actions
    Infos
    #42977
    Thomas Gerbet (tgerbet)
    2025-05-09 16:22
    2025-05-09 15:49
    44659
    Details
    Harden CSRF protection by blocking all cross-site state modifying queries to the Web UI

    By blocking all non-GET/HEAD requests with a Sec-Fetch-Site header set to something else than none or same-origin we could harden our CSRF protection.

    For reference Tuleap already do something equivalent for the REST endpoints.

    Other
    All
    Empty
    • [ ] enhancement
    • [ ] internal improvement
    Empty
    Stage
    Thomas Gerbet (tgerbet)
    Under review
    Empty
    Attachments
    Empty
    References
    Referenced by request #42977

    Other

    gerrit #34413
    Display settings

    Follow-ups