don't require anti-csrf header with curl
Massimo Melina committed
Nov 9, 2024 at 23:11 UTC
bcf27a7015adb17c95013a69c4a6fca7ffbb6f66
1 file changed
+1
-1
src/apiMiddleware.ts
+1
-1
@@ -29,7 +29,7 @@ export function apiMiddleware(apis: ApiHandlers) : Koa.Middleware {
29
const apiName = ctx.path
30
console.debug('API', ctx.method, apiName, { ...params })
31
const noBrowser = ctx.get('user-agent')?.startsWith('curl')
32
- const safe = isPost && (!noBrowser || ctx.get('x-hfs-anti-csrf')) // POST is safe because browser will enforce SameSite cookie
32
+ const safe = !noBrowser || isPost && ctx.get('x-hfs-anti-csrf') // POST is safe because browser will enforce SameSite cookie
33
|| apiName.startsWith('get_') // "get_" apis are safe because they make no change
34
if (!safe)
35
return send(HTTP_FOOL, "missing header x-hfs-anti-csrf=1")