You cannot select more than 25 topics Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
tailscale/client/web
Patrick O'Doherty a05924a9e5
client/web: add Sec-Fetch-Site CSRF protection (#16046)
RELNOTE=Fix CSRF errors in the client Web UI

Replace gorilla/csrf with a Sec-Fetch-Site based CSRF protection
middleware that falls back to comparing the Host & Origin headers if no
SFS value is passed by the client.

Add an -origin override to the web CLI that allows callers to specify
the origin at which the web UI will be available if it is hosted behind
a reverse proxy or within another application via CGI.

Updates #14872
Updates #15065

Signed-off-by: Patrick O'Doherty <patrick@tailscale.com>
7 months ago
..
build client/web: precompress assets 2 years ago
src client/web: add Sec-Fetch-Site CSRF protection (#16046) 7 months ago
assets.go client/web: only add cache header for assets 2 years ago
auth.go all: use Go 1.22 range-over-int 2 years ago
index.html client/web: use CSP hash for inline javascript 2 years ago
package.json node.rev: bump to latest 22.x LTS release (#15652) 8 months ago
qnap.go client/web: add readonly/manage toggle 2 years ago
styles.json client/web: adjust colors and some UI margins 2 years ago
synology.go client/web: add readonly/manage toggle 2 years ago
tailwind.config.js client/web: fix Vite CJS deprecation warning (#11288) 2 years ago
tsconfig.json client/web: update vite and vitest to latest versions (#11200) 2 years ago
vite.config.ts client/web: update vite and vitest to latest versions (#11200) 2 years ago
web.go client/web: add Sec-Fetch-Site CSRF protection (#16046) 7 months ago
web_test.go client/web: add Sec-Fetch-Site CSRF protection (#16046) 7 months ago
yarn.lock node.rev: bump to latest 22.x LTS release (#15652) 8 months ago