Patrick O'Doherty 4a39a47248

safeweb: replace gorilla with Sec-Fetch-Site check ...

Require that all non-(GET|OPTIONS|HEAD) requests to the browser mux
specify Sec-Fetch-Site=same-origin to prohibit cross-origin requests.

Optionally allow for requests to specify "same-site" indicating a
cross-origin request from an origin that shares a root domain with the
application's own.

Updates tailscale/corp#25340

2025-04-24 17:44:15 -07:00

..

http_test.go

safeweb: replace gorilla with Sec-Fetch-Site check

2025-04-24 17:44:15 -07:00

http.go

safeweb: replace gorilla with Sec-Fetch-Site check

2025-04-24 17:44:15 -07:00