bvandeusenandClaude Opus 5.5
96126b1c83
#5031 "Forged-request protection: SameSite cookie, per-session CSRF token on every non-GET, HTMX header". A page on another site could make a logged-in browser POST to Steward with the session cookie attached. - steward/auth/csrf.py: a per-session token, checked in one before_request for every POST/PUT/PATCH/DELETE (header X-CSRF-Token or form field csrf_token, constant-time compare). The bearer-authenticated host-agent ingest is exempt; /mcp never reaches Quart. - Every POST form renders {{ csrf_field() }}; base.html carries the token in a meta tag and adds it to every HTMX request; the dashboard's fetch() calls send it. - The session cookie is SameSite=Lax; login issues a fresh token. - PUBLIC_BASE_URL is now loaded from Settings at startup (it was only set when Settings → General was saved). - tests/test_csrf.py: refusal, acceptance, rotation, the ingest exemption, and a guard that every POST form in the templates carries the field. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
31 lines
1.7 KiB
HTML
31 lines
1.7 KiB
HTML
{% extends "base.html" %}
|
|
{% from "_macros.html" import crumbs %}
|
|
{% block title %}{% if host %}Edit Host{% else %}New Host{% endif %} — Steward{% endblock %}
|
|
{% block breadcrumb %}{{ crumbs([("Hosts", "/hosts/"), (("Edit " ~ host.name) if host else "New host", "")]) }}{% endblock %}
|
|
{% block content %}
|
|
<div style="max-width:560px;margin:2rem auto;">
|
|
<h1 class="page-title">{% if host %}Edit Host{% else %}Add Host{% endif %}</h1>
|
|
<div class="card">
|
|
<form method="post" action="{% if host %}/hosts/{{ host.id }}{% else %}/hosts/{% endif %}">{{ csrf_field() }}
|
|
<div class="form-group">
|
|
<label>Display Name</label>
|
|
<input type="text" name="name" value="{{ host.name if host else '' }}" required autofocus>
|
|
</div>
|
|
<div class="form-group">
|
|
<label>Address (hostname or IP)</label>
|
|
<input type="text" name="address" value="{{ host.address if host else '' }}" required>
|
|
</div>
|
|
<div style="display:flex;gap:1rem;margin-top:1.5rem;">
|
|
<button type="submit" class="btn">{% if host %}Save{% else %}Add Host{% endif %}</button>
|
|
<a href="{% if host %}/hosts/{{ host.id }}{% else %}/hosts/{% endif %}" class="btn btn-ghost">Cancel</a>
|
|
</div>
|
|
</form>
|
|
</div>
|
|
<p style="color:var(--text-muted);font-size:0.82rem;margin-top:1rem;text-align:center;">
|
|
{% if host %}Monitors, agent, Ansible target, and playbook runs live on the
|
|
<a href="/hosts/{{ host.id }}">host page</a>.{% else %}
|
|
After adding, attach ping / DNS / HTTP monitors from the host page.{% endif %}
|
|
</p>
|
|
</div>
|
|
{% endblock %}
|