colem/todo-hetzner
1
0
Fork 0
mirror of https://github.com/cole-maxwell1/todo-hetzner.git synced 2026-10-27 19:02:49 -05:00
Code Issues Packages Projects Releases Wiki Activity

fix(handler): preserve origin on form submissions

Browse Source 
Use the same-origin referrer policy to prevent Chrome from sending a null Origin header on POST requests.
This commit is contained in:
cole-maxwell1
2026-08-07 15:30:49 -05:00
parent b8f655ac58
commit 94d18ff8e2
2 changed files with 4 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
app/internal/handler/handler.go
+1 -1
View File
@@ -131,7 +131,7 @@ func (h *Handler) serverError(w http.ResponseWriter, r *http.Request, err error)
func (h *Handler) security(next http.Handler) http.Handler { func (h *Handler) security(next http.Handler) http.Handler {
return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) { return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
w.Header().Set("Content-Security-Policy", "default-src 'self'; style-src 'self'; form-action 'self'; frame-ancestors 'none'; base-uri 'self'") w.Header().Set("Content-Security-Policy", "default-src 'self'; style-src 'self'; form-action 'self'; frame-ancestors 'none'; base-uri 'self'")
w.Header().Set("Referrer-Policy", "no-referrer") w.Header().Set("Referrer-Policy", "same-origin")
w.Header().Set("X-Content-Type-Options", "nosniff") w.Header().Set("X-Content-Type-Options", "nosniff")
w.Header().Set("X-Frame-Options", "DENY") w.Header().Set("X-Frame-Options", "DENY")
next.ServeHTTP(w, r) next.ServeHTTP(w, r)
app/internal/handler/handler_test.go
+3
View File
@@ -56,6 +56,9 @@ func TestListRendersEscapedTodos(t *testing.T) {
if strings.Contains(recorder.Body.String(), "<script>") || !strings.Contains(recorder.Body.String(), "&lt;script&gt;") { if strings.Contains(recorder.Body.String(), "<script>") || !strings.Contains(recorder.Body.String(), "&lt;script&gt;") {
t.Fatalf("title was not escaped: %s", recorder.Body.String()) t.Fatalf("title was not escaped: %s", recorder.Body.String())
} }
if got := recorder.Header().Get("Referrer-Policy"); got != "same-origin" {
t.Fatalf("Referrer-Policy = %q, want %q", got, "same-origin")
}
} }
func TestCreateValidatesAndTrimsTitle(t *testing.T) { func TestCreateValidatesAndTrimsTitle(t *testing.T) {