silverwind 42d294941c Replace CSRF cookie with CrossOriginProtection (#36183) ...

Removes the CSRF cookie in favor of
[`CrossOriginProtection`](https://pkg.go.dev/net/http#CrossOriginProtection)
which relies purely on HTTP headers.

Fixes: https://github.com/go-gitea/gitea/issues/11188
Fixes: https://github.com/go-gitea/gitea/issues/30333
Helps: https://github.com/go-gitea/gitea/issues/35107

TODOs:

- [x] Fix tests
- [ ] Ideally add tests to validates the protection

---------

Signed-off-by: wxiaoguang <wxiaoguang@gmail.com>
Co-authored-by: wxiaoguang <wxiaoguang@gmail.com>

2025-12-25 12:33:34 +02:00

..

security

Replace CSRF cookie with CrossOriginProtection (#36183)

2025-12-25 12:33:34 +02:00

account.tmpl

Replace CSRF cookie with CrossOriginProtection (#36183)

2025-12-25 12:33:34 +02:00

actions.tmpl

Support configuration variables on Gitea Actions (#24724)

2023-06-20 22:54:15 +00:00

appearance.tmpl

Replace CSRF cookie with CrossOriginProtection (#36183)

2025-12-25 12:33:34 +02:00

applications_oauth2_edit_form.tmpl

Replace CSRF cookie with CrossOriginProtection (#36183)

2025-12-25 12:33:34 +02:00

applications_oauth2_edit.tmpl

Change to vertical navbar layout for secondary navbar for repo/user/admin settings (#24246)

2023-04-23 18:21:21 +08:00

applications_oauth2_list.tmpl

Replace CSRF cookie with CrossOriginProtection (#36183)

2025-12-25 12:33:34 +02:00

applications_oauth2.tmpl

Always use ctx.Locale.Tr inside templates (#27231)

2023-09-25 08:56:50 +00:00

applications.tmpl

Replace CSRF cookie with CrossOriginProtection (#36183)

2025-12-25 12:33:34 +02:00

blocked_users.tmpl

Add user blocking (#29028)

2024-03-04 08:16:03 +00:00

grants_oauth2.tmpl

Refactor DateUtils and merge TimeSince (#32409)

2024-11-04 11:30:00 +00:00

hook_new.tmpl

Always use ctx.Locale.Tr inside templates (#27231)

2023-09-25 08:56:50 +00:00

hooks.tmpl

Refactor webhook and fix feishu/lark secret (#34961)

2025-07-06 06:04:08 +00:00

keys_gpg.tmpl

Replace CSRF cookie with CrossOriginProtection (#36183)

2025-12-25 12:33:34 +02:00

keys_principal.tmpl

Replace CSRF cookie with CrossOriginProtection (#36183)

2025-12-25 12:33:34 +02:00

keys_ssh.tmpl

Replace CSRF cookie with CrossOriginProtection (#36183)

2025-12-25 12:33:34 +02:00

keys.tmpl

Allow options to disable user ssh keys configuration from the interface on app.ini (#29447)

2024-03-04 07:50:21 +00:00

layout_footer.tmpl

Change to vertical navbar layout for secondary navbar for repo/user/admin settings (#24246)

2023-04-23 18:21:21 +08:00

layout_head.tmpl

Reduce margins on user settings page, introduce flex-container (#26046)

2023-07-31 07:16:03 +00:00

navbar.tmpl

Add Notifications section in User Settings (#35008)

2025-07-11 10:17:52 +08:00

notifications.tmpl

Replace CSRF cookie with CrossOriginProtection (#36183)

2025-12-25 12:33:34 +02:00

organization.tmpl

Replace CSRF cookie with CrossOriginProtection (#36183)

2025-12-25 12:33:34 +02:00

packages_cleanup_rules_edit.tmpl

Change to vertical navbar layout for secondary navbar for repo/user/admin settings (#24246)

2023-04-23 18:21:21 +08:00

packages_cleanup_rules_preview.tmpl

Change to vertical navbar layout for secondary navbar for repo/user/admin settings (#24246)

2023-04-23 18:21:21 +08:00

packages.tmpl

Replace CSRF cookie with CrossOriginProtection (#36183)

2025-12-25 12:33:34 +02:00

profile.tmpl

Replace CSRF cookie with CrossOriginProtection (#36183)

2025-12-25 12:33:34 +02:00

repos.tmpl

Replace CSRF cookie with CrossOriginProtection (#36183)

2025-12-25 12:33:34 +02:00

runner_edit.tmpl

Add user level action runners (#24995)

2023-05-31 09:39:54 +08:00