gamertan/web
1
0
Fork 0
Code Issues Pull Requests Actions Packages Releases 3 Activity

security: harden first preview boundaries
verify / verify (push) Successful in 3m1s
Details

Browse Source 
Sanitized snapshot of private source 13a965dd6ea705dd92499f7dbeaa00c25c15247d. Require same-origin evidence for unsafe methods, fail closed on invalid authentication middleware configuration, and bound untrusted request metadata.

AI-Assistance: OpenAI Codex assisted implementation, testing, and security review.
Signed-off-by: Cole Speelman <crspeelman@gmail.com>
This commit is contained in:
gamertan
2026-08-16 19:20:14 -04:00
parent df946d888e
commit a18f1dd22a
13 changed files with 181 additions and 12 deletions
Download Patch File Download Diff File Expand all files Collapse all files
websec/websec.go
+13 -4
View File
@@ -76,19 +76,28 @@ func RequireHTTPS(next http.Handler) http.Handler {
// SameOrigin accepts browser requests that are demonstrably same-origin. It
// rejects contradictory fetch metadata even when Origin is absent.
func SameOrigin(request *http.Request, allowedOrigin string) bool {
if site := strings.ToLower(strings.TrimSpace(request.Header.Get("Sec-Fetch-Site"))); site != "" && site != "same-origin" && site != "none" {
site := strings.ToLower(strings.TrimSpace(request.Header.Get("Sec-Fetch-Site")))
if site != "" && site != "same-origin" && site != "none" {
return false
}
origin := strings.TrimSpace(request.Header.Get("Origin"))
if origin == "" {
return true
if site == "same-origin" || site == "none" {
return true
}
switch request.Method {
case http.MethodGet, http.MethodHead, http.MethodOptions:
return true
default:
return false
}
}
want, err := url.Parse(allowedOrigin)
if err != nil || want.Scheme == "" || want.Host == "" || want.Path != "" {
if err != nil || want.Scheme == "" || want.Host == "" || want.Path != "" || want.RawQuery != "" || want.Fragment != "" || want.User != nil {
return false
}
got, err := url.Parse(origin)
return err == nil && strings.EqualFold(got.Scheme, want.Scheme) && strings.EqualFold(got.Host, want.Host) && got.Path == "" && got.RawQuery == "" && got.Fragment == ""
return err == nil && got.User == nil && strings.EqualFold(got.Scheme, want.Scheme) && strings.EqualFold(got.Host, want.Host) && got.Path == "" && got.RawQuery == "" && got.Fragment == ""
}
// CSRFToken binds a purpose to opaque session secret material.