bvandeusenandClaude Opus 5.5
96126b1c83
#5031 "Forged-request protection: SameSite cookie, per-session CSRF token on every non-GET, HTMX header". A page on another site could make a logged-in browser POST to Steward with the session cookie attached. - steward/auth/csrf.py: a per-session token, checked in one before_request for every POST/PUT/PATCH/DELETE (header X-CSRF-Token or form field csrf_token, constant-time compare). The bearer-authenticated host-agent ingest is exempt; /mcp never reaches Quart. - Every POST form renders {{ csrf_field() }}; base.html carries the token in a meta tag and adds it to every HTMX request; the dashboard's fetch() calls send it. - The session cookie is SameSite=Lax; login issues a fresh token. - PUBLIC_BASE_URL is now loaded from Settings at startup (it was only set when Settings → General was saved). - tests/test_csrf.py: refusal, acceptance, rotation, the ingest exemption, and a guard that every POST form in the templates carries the field. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
21 lines
894 B
HTML
21 lines
894 B
HTML
{# settings/_install_result.html — inline result after install/reload action #}
|
|
<div id="catalog-result-{{ name }}"
|
|
style="margin-top:0.6rem;padding:0.5rem 0.75rem;border-radius:5px;font-size:0.82rem;
|
|
background:{% if success %}var(--green-dim){% else %}var(--red-dim){% endif %};
|
|
color:{% if success %}var(--green){% else %}#ff8090{% endif %};">
|
|
{{ message }}
|
|
{% if restart_required %}
|
|
·
|
|
<form method="post" action="/settings/plugins/restart/"
|
|
hx-post="/settings/plugins/restart/"
|
|
hx-target="#restart-banner"
|
|
hx-swap="outerHTML"
|
|
style="display:inline;margin:0;">{{ csrf_field() }}
|
|
<button type="submit"
|
|
style="background:none;border:none;padding:0;color:var(--yellow);cursor:pointer;font-size:0.82rem;text-decoration:underline;">
|
|
Restart now
|
|
</button>
|
|
</form>
|
|
{% endif %}
|
|
</div>
|