don't require anti-csrf header with curl
Massimo Melina committed
May 30, 2024 at 14:05 UTC
4a98f3a2dc59fedfb5d858ad438350b5aeab379b
1 file changed
+3
-2
src/apiMiddleware.ts
+3
-2
@@ -3,7 +3,7 @@
3
import Koa from 'koa'
4
import createSSE from './sse'
5
import { Readable } from 'stream'
6
-import { asyncGeneratorToReadable, CFG, Promisable, removeStarting } from './misc'
6
+import { asyncGeneratorToReadable, CFG, Promisable } from './misc'
7
import { HTTP_BAD_REQUEST, HTTP_FOOL, HTTP_NOT_FOUND } from './const'
8
import { defineConfig } from './config'
9
@@ -26,7 +26,8 @@ export function apiMiddleware(apis: ApiHandlers) : Koa.Middleware {
26
const params = isPost ? ctx.state.params || {} : ctx.query
27
const apiName = ctx.path
28
console.debug('API', ctx.method, apiName, { ...params })
29
- const safe = isPost && ctx.get('x-hfs-anti-csrf') // POST is safe because browser will enforce SameSite cookie
29
+ const noBrowser = ctx.get('user-agent')?.startsWith('curl')
30
+ const safe = isPost && (!noBrowser || ctx.get('x-hfs-anti-csrf')) // POST is safe because browser will enforce SameSite cookie
31
|| apiName.startsWith('get_') // "get_" apis are safe because they make no change
32
if (!safe)
33
return send(HTTP_FOOL, "missing header x-hfs-anti-csrf=1")