ember/continuwuity
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions 1

fix: Add CSRF protection

Browse source
This commit is contained in:
Ginger 2026-03-03 14:30:16 -05:00
parent d13801e976
commit 07a935f625
No known key found for this signature in database
3 changed files with 18 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

13
Cargo.lock generated
View file

@ -1181,6 +1181,7 @@ dependencies = [
"serde", "serde",
"thiserror 2.0.18", "thiserror 2.0.18",
"tower-http", "tower-http",
"tower-sec-fetch",
"tracing", "tracing",
"validator", "validator",
] ]
@ -5799,6 +5800,18 @@ version = "0.3.3"
source = "registry+https://github.com/rust-lang/crates.io-index" source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "121c2a6cda46980bb0fcd1647ffaf6cd3fc79a013de288782836f6df9c48780e" checksum = "121c2a6cda46980bb0fcd1647ffaf6cd3fc79a013de288782836f6df9c48780e"
[[package]]
name = "tower-sec-fetch"
version = "0.1.2"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "ff1e78d241de2527d3ef67e49d65d8cb08468c644c3aafac7a988c4accd76547"
dependencies = [
"futures",
"http",
"tower",
"tracing",
]
[[package]] [[package]]
name = "tower-service" name = "tower-service"
version = "0.3.3" version = "0.3.3"

1
src/web/Cargo.toml
View file

@ -35,6 +35,7 @@ tower-http.workspace = true
serde.workspace = true serde.workspace = true
memory-serve = "2.1.0" memory-serve = "2.1.0"
validator = { version = "0.20.0", features = ["derive"] } validator = { version = "0.20.0", features = ["derive"] }
tower-sec-fetch = { version = "0.1.2", features = ["tracing"] }
[build-dependencies] [build-dependencies]
memory-serve = "2.1.0" memory-serve = "2.1.0"

4
src/web/mod.rs
View file

@ -6,6 +6,7 @@ use axum::{
}; };
use conduwuit_service::state; use conduwuit_service::state;
use tower_http::set_header::SetResponseHeaderLayer; use tower_http::set_header::SetResponseHeaderLayer;
use tower_sec_fetch::SecFetchLayer;
mod pages; mod pages;
@ -60,4 +61,7 @@ pub fn build() -> Router<state::State> {
header::CONTENT_SECURITY_POLICY, header::CONTENT_SECURITY_POLICY,
HeaderValue::from_static("default-src 'self'; img-src 'self' data:;"), HeaderValue::from_static("default-src 'self'; img-src 'self' data:;"),
)) ))
.layer(SecFetchLayer::new(|policy| {
policy.allow_safe_methods().reject_missing_metadata();
}))
} }