admin: Reject requests with Sec-Fetch-Mode headers

And buggy Origin: null headers. Resolves a low-risk security report by @1seal.

Matthew Holt committed Feb 5, 2026 at 09:39 UTC 42ca010e9d8da35e91edd69e724d3736678b5620

1 file changed +26 -1

admin.go

+26 -1

@@ -807,13 +807,38 @@ func (h adminHandler) serveHTTP(w http.ResponseWriter, r *http.Request) {

807 }

808 }

809

810 + // common mitigations in browser contexts

811 if strings.Contains(r.Header.Get("Upgrade"), "websocket") {

812 // I've never been able demonstrate a vulnerability myself, but apparently

813 // WebSocket connections originating from browsers aren't subject to CORS

814 // restrictions, so we'll just be on the safe side

814 - h.handleError(w, r, fmt.Errorf("websocket connections aren't allowed"))

815 + h.handleError(w, r, APIError{

816 + HTTPStatus: http.StatusBadRequest,

817 + Err: errors.New("websocket connections aren't allowed"),

818 + Message: "WebSocket connections aren't allowed.",

819 + })

820 return

821 }

822 + if strings.Contains(r.Header.Get("Sec-Fetch-Mode"), "no-cors") {

823 + // turns out web pages can just disable the same-origin policy (!???!?)

824 + // but at least browsers let us know that's the case, holy heck

825 + h.handleError(w, r, APIError{

826 + HTTPStatus: http.StatusBadRequest,

827 + Err: errors.New("client attempted to make request by disabling same-origin policy using no-cors mode"),

828 + Message: "Disabling same-origin restrictions is not allowed.",

829 + })

830 + return

831 + }

832 + if r.Header.Get("Origin") == "null" {

833 + // bug in Firefox in certain cross-origin situations (yikes?)

834 + // (not strictly a security vuln on its own, but it's red flaggy,

835 + // since it seems to manifest in cross-origin contexts)

836 + h.handleError(w, r, APIError{

837 + HTTPStatus: http.StatusBadRequest,

838 + Err: errors.New("invalid origin 'null'"),

839 + Message: "Buggy browser is sending null Origin header.",

840 + })

841 + }

842

843 if h.enforceHost {

844 // DNS rebinding mitigation