Login

Ben / RubHub

Overview Code Talk CI Settings
4 branches 0 tags
Ben Create issue: Add /~user/keys endpoint 0e37be6 22 days ago 77 Commits
rubhub / issues / 2025-12-25-19-05-13-801-simplify-csrf-protection / 2025-12-25-19-05-13-801-ben.md
Raw Source
text/markdown • 363 B • 8 lines
date
2025-12-25T19:05:13.801993361Z
author
ben
email
bennyschulenburg@gmx.de
title
Simplify CSRF protection

While researching it some more it seems that using SameSite=lax and making sure that only POST requests change state should be enough, additionally I might check for Sec-Fetch-Site and referrer headers and block the request if the value wrong