Patrick O'Doherty a05924a9e5

client/web: add Sec-Fetch-Site CSRF protection (#16046) ...

RELNOTE=Fix CSRF errors in the client Web UI

Replace gorilla/csrf with a Sec-Fetch-Site based CSRF protection
middleware that falls back to comparing the Host & Origin headers if no
SFS value is passed by the client.

Add an -origin override to the web CLI that allows callers to specify
the origin at which the web UI will be available if it is hosted behind
a reverse proxy or within another application via CGI.

Updates #14872
Updates #15065

Signed-off-by: Patrick O'Doherty <patrick@tailscale.com>

2025-05-22 12:26:02 -07:00

..

cli

client/web: add Sec-Fetch-Site CSRF protection (#16046)

2025-05-22 12:26:02 -07:00

depaware.txt

client/web: add Sec-Fetch-Site CSRF protection (#16046)

2025-05-22 12:26:02 -07:00

generate.go

cmd/mkmanifest, cmd/tailscale, cmd/tailscaled: remove Windows arm32 resources from OSS

2023-03-01 15:45:12 -07:00

manifest_windows_386.syso

cmd/{tailscale,tailscaled}: embed manifest into Windows binaries

2022-11-21 18:15:51 -05:00

manifest_windows_amd64.syso

cmd/{tailscale,tailscaled}: embed manifest into Windows binaries

2022-11-21 18:15:51 -05:00

manifest_windows_arm64.syso

cmd/{tailscale,tailscaled}: embed manifest into Windows binaries

2022-11-21 18:15:51 -05:00

tailscale_test.go

net/ipset, wgengine/filter/filtertype: add split-out packages

2024-06-16 15:25:23 -07:00

tailscale.go

all: update copyright and license headers

2023-01-27 15:36:29 -08:00

tailscale.rc

cmd/tailscale: add tailscale.rc Plan 9 wrapper

2025-04-02 07:36:04 -07:00

windows-manifest.xml

cmd/{tailscale,tailscaled}: embed manifest into Windows binaries

2022-11-21 18:15:51 -05:00