Fast and extensible multi-platform HTTP/1-2-3 web server with automatic HTTPS
Mirrored from https://github.com/Slazee/caddy.git
Synced Nov 11, 16:00 UTC
admin: Enforce origin implicitly based on request headers
Matthew Holt committed
Feb 11, 2026 at 09:52 UTC
72ac479f5d0472425fe150c4aacd03d1030b0077
1 file changed
+3
-1
admin.go
+3
-1
@@ -849,7 +849,9 @@ func (h adminHandler) serveHTTP(w http.ResponseWriter, r *http.Request) {
849
}
850
}
851
852
- if h.enforceOrigin {
852
+ _, hasOriginHeader := r.Header["Origin"]
853
+ _, hasSecHeader := r.Header["Sec-Fetch-Mode"]
854
+ if h.enforceOrigin || hasOriginHeader || hasSecHeader {
855
// cross-site mitigation
856
origin, err := h.checkOrigin(r)
857
if err != nil {