Paul Fitzpatrick bd6a54e901 (core) mitigate csrf by requiring custom header for unsafe methods ... Summary: For methods other than `GET`, `HEAD`, and `OPTIONS`, allow cookie-based authentication only if a certain custom header is present. Specifically, we check that `X-Requested-With` is set to `XMLHttpRequest`. This is somewhat arbitrary, but allows us to use https://expressjs.com/en/api.html#req.xhr. A request send from a browser that sets a custom header will prompt a preflight check, giving us a chance to check if the origin is trusted. This diff deals with getting the header in place. There will be more work to do after this: * Make sure that all important endpoints are checking origin. Skimming code, /api endpoint check origin, and some but not all others. * Add tests spot-testing origin checks. * Check on cases that authenticate differently. - Check the websocket endpoint - it can be connected to from an arbitrary site; there is per-doc access control but probably better to lock it down more. - There may be old endpoints that authenticate based on knowledge of a client id rather than cookies. Test Plan: added a test Reviewers: dsagal Reviewed By: dsagal Differential Revision: https://phab.getgrist.com/D2631		2020-10-08 14:19:25 -04:00
..
entities	(core) move client code to core	2020-10-02 13:24:21 -04:00
AppModel.ts	(core) move client code to core	2020-10-02 13:24:21 -04:00
BaseRowModel.js	(core) move client code to core	2020-10-02 13:24:21 -04:00
BillingModel.ts	(core) move client code to core	2020-10-02 13:24:21 -04:00
ClientColumnGetters.ts	(core) move client code to core	2020-10-02 13:24:21 -04:00
ColumnACIndexes.ts	(core) move client code to core	2020-10-02 13:24:21 -04:00
ColumnFilter.ts	(core) move client code to core	2020-10-02 13:24:21 -04:00
ConnectState.ts	(core) move client code to core	2020-10-02 13:24:21 -04:00
DataRowModel.ts	(core) move client code to core	2020-10-02 13:24:21 -04:00
DataTableModel.js	(core) move client code to core	2020-10-02 13:24:21 -04:00
DataTableModelWithDiff.ts	(core) move client code to core	2020-10-02 13:24:21 -04:00
DocData.ts	(core) move client code to core	2020-10-02 13:24:21 -04:00
DocListModel.js	(core) move client code to core	2020-10-02 13:24:21 -04:00
DocModel.ts	(core) move client code to core	2020-10-02 13:24:21 -04:00
DocPageModel.ts	(core) move client code to core	2020-10-02 13:24:21 -04:00
errors.ts	(core) mitigate csrf by requiring custom header for unsafe methods	2020-10-08 14:19:25 -04:00
gristConfigCache.ts	(core) move client code to core	2020-10-02 13:24:21 -04:00
gristUrlState.ts	(core) Enhancements to the Public Access UI.	2020-09-23 18:54:23 -04:00
HomeModel.ts	(core) move client code to core	2020-10-02 13:24:21 -04:00
MetaRowModel.js	(core) move client code to core	2020-10-02 13:24:21 -04:00
MetaTableModel.js	(core) move client code to core	2020-10-02 13:24:21 -04:00
modelUtil.js	(core) move client code to core	2020-10-02 13:24:21 -04:00
NotifyModel.ts	(core) move client code to core	2020-10-02 13:24:21 -04:00
QuerySet.ts	(core) move client code to core	2020-10-02 13:24:21 -04:00
rowset.ts	(core) move client code to core	2020-10-02 13:24:21 -04:00
rowuid.js	(core) move client code to core	2020-10-02 13:24:21 -04:00
SearchModel.ts	(core) move client code to core	2020-10-02 13:24:21 -04:00
SectionFilter.ts	(core) move client code to core	2020-10-02 13:24:21 -04:00
TableData.ts	(core) move client code to core	2020-10-02 13:24:21 -04:00
TableModel.js	(core) move client code to core	2020-10-02 13:24:21 -04:00
TreeModel.ts	(core) move client code to core	2020-10-02 13:24:21 -04:00
UserManagerModel.ts	(core) move client code to core	2020-10-02 13:24:21 -04:00
UserPrefs.ts	(core) move client code to core	2020-10-02 13:24:21 -04:00
WorkspaceInfo.ts	(core) move client code to core	2020-10-02 13:24:21 -04:00