linx-server

64 Tags

2.0 MiB

Tree: a7ae455ac1

Author	SHA1	Message	Date
mutantmonkey	a7ae455ac1	strict referrer check improvements * Always check Origin if it is present, regardless of headers sent * Whitelist X-Requested-With header	9 years ago
mutantmonkey	cd83f9f0eb	fix CSP referrer policy The policy of "referrer none" was incorrect and was nonfunctional. With this change, the CSP referrer policy is set to origin, which will causes only the origin to be sent for requests made from the main site. A fix was also needed for referrer checks in two places.	9 years ago
mutantmonkey	39d874374d	trim trailing / for origin checking	9 years ago
mutantmonkey	6ff181facb	add strict referrer check for POST uploads This should protect against cross-site request forgery without the need for cookies. It continues to allow requests with Linx-Delete-Key, Linx-Expiry, or Linx-Randomize headers as these will not be set in the case of cross-site requests.	9 years ago