Paul Fitzpatrick bd6a54e901 (core) mitigate csrf by requiring custom header for unsafe methods ... Summary: For methods other than `GET`, `HEAD`, and `OPTIONS`, allow cookie-based authentication only if a certain custom header is present. Specifically, we check that `X-Requested-With` is set to `XMLHttpRequest`. This is somewhat arbitrary, but allows us to use https://expressjs.com/en/api.html#req.xhr. A request send from a browser that sets a custom header will prompt a preflight check, giving us a chance to check if the origin is trusted. This diff deals with getting the header in place. There will be more work to do after this: * Make sure that all important endpoints are checking origin. Skimming code, /api endpoint check origin, and some but not all others. * Add tests spot-testing origin checks. * Check on cases that authenticate differently. - Check the websocket endpoint - it can be connected to from an arbitrary site; there is per-doc access control but probably better to lock it down more. - There may be old endpoints that authenticate based on knowledge of a client id rather than cookies. Test Plan: added a test Reviewers: dsagal Reviewed By: dsagal Differential Revision: https://phab.getgrist.com/D2631		2020-10-08 14:19:25 -04:00
..
ACIndex.ts	(core) move client code to core	2020-10-02 13:24:21 -04:00
autocomplete.ts	(core) move client code to core	2020-10-02 13:24:21 -04:00
browserGlobals.js	(core) move client code to core	2020-10-02 13:24:21 -04:00
browserInfo.ts	(core) move client code to core	2020-10-02 13:24:21 -04:00
chartUtil.ts	(core) move client code to core	2020-10-02 13:24:21 -04:00
copyToClipboard.ts	(core) move client code to core	2020-10-02 13:24:21 -04:00
CustomSectionElement.ts	(core) move client code to core	2020-10-02 13:24:21 -04:00
Delay.ts	(core) move client code to core	2020-10-02 13:24:21 -04:00
dispose.d.ts	(core) move client code to core	2020-10-02 13:24:21 -04:00
dispose.js	(core) move client code to core	2020-10-02 13:24:21 -04:00
DocPluginManager.ts	(core) move client code to core	2020-10-02 13:24:21 -04:00
dom.js	(core) move client code to core	2020-10-02 13:24:21 -04:00
domAsync.ts	(core) move client code to core	2020-10-02 13:24:21 -04:00
download.js	(core) move client code to core	2020-10-02 13:24:21 -04:00
FocusLayer.ts	(core) Improve focus and keyboard shortcuts in modals.	2020-10-03 22:56:00 -04:00
fromKoSave.ts	(core) move client code to core	2020-10-02 13:24:21 -04:00
guessTimezone.ts	(core) move client code to core	2020-10-02 13:24:21 -04:00
helpScout.ts	(core) move client code to core	2020-10-02 13:24:21 -04:00
imports.d.ts	(core) move client code to core	2020-10-02 13:24:21 -04:00
imports.js	(core) move client code to core	2020-10-02 13:24:21 -04:00
ImportSourceElement.ts	(core) move client code to core	2020-10-02 13:24:21 -04:00
koArray.d.ts	(core) move client code to core	2020-10-02 13:24:21 -04:00
koArray.js	(core) move client code to core	2020-10-02 13:24:21 -04:00
koArrayWrap.ts	(core) move client code to core	2020-10-02 13:24:21 -04:00
koDom.js	(core) move client code to core	2020-10-02 13:24:21 -04:00
koDomScrolly.css	(core) move client code to core	2020-10-02 13:24:21 -04:00
koDomScrolly.js	(core) move client code to core	2020-10-02 13:24:21 -04:00
koForm.css	(core) move client code to core	2020-10-02 13:24:21 -04:00
koForm.js	(core) move client code to core	2020-10-02 13:24:21 -04:00
koSession.js	(core) move client code to core	2020-10-02 13:24:21 -04:00
koUtil.js	(core) move client code to core	2020-10-02 13:24:21 -04:00
listEntry.ts	(core) move client code to core	2020-10-02 13:24:21 -04:00
loadScript.js	(core) move client code to core	2020-10-02 13:24:21 -04:00
localStorageObs.ts	(core) move client code to core	2020-10-02 13:24:21 -04:00
log.ts	(core) support ?embed=true and &style=light for a clean embed experience	2020-08-14 13:34:38 -04:00
Mousetrap.js	(core) Improve focus and keyboard shortcuts in modals.	2020-10-03 22:56:00 -04:00
multiselect.css	(core) move client code to core	2020-10-02 13:24:21 -04:00
multiselect.js	(core) move client code to core	2020-10-02 13:24:21 -04:00
ObservableMap.js	(core) move client code to core	2020-10-02 13:24:21 -04:00
ObservableSet.js	(core) move client code to core	2020-10-02 13:24:21 -04:00
SafeBrowser.ts	(core) move client code to core	2020-10-02 13:24:21 -04:00
SafeBrowserProcess.css	(core) move client code to core	2020-10-02 13:24:21 -04:00
sessionObs.ts	(core) move client code to core	2020-10-02 13:24:21 -04:00
sortUtil.ts	(core) move client code to core	2020-10-02 13:24:21 -04:00
tableUtil.js	(core) move client code to core	2020-10-02 13:24:21 -04:00
testState.ts	(core) move client code to core	2020-10-02 13:24:21 -04:00
uploads.ts	(core) mitigate csrf by requiring custom header for unsafe methods	2020-10-08 14:19:25 -04:00
UrlState.ts	(core) support ?embed=true and &style=light for a clean embed experience	2020-08-14 13:34:38 -04:00