Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Dependabot Alert: Atro CSRF Middleware Bypass (security.checkOrigin) #720

Open
JennaySDavis opened this issue Dec 18, 2024 · 2 comments
Open

Dependabot Alert: Atro CSRF Middleware Bypass (security.checkOrigin) #720

JennaySDavis opened this issue Dec 18, 2024 · 2 comments
Assignees
@johnbeallgsa
Labels
Addition to Sprint The ticket is in addition to the planned sprint work Dependabot Alert Sprint 47

Comments

@JennaySDavis
Copy link
Contributor

A bug in Astro’s CSRF-protection middleware allows requests to bypass CSRF checks.

Details
When the security.checkOrigin configuration option is set to true, Astro middleware will perform a CSRF check. (Source code: https://github.com/withastro/astro/blob/6031962ab5f56457de986eb82bd24807e926ba1b/packages/astro/src/core/app/middlewares.ts)
@felder101 felder101 added Sprint 47 Addition to Sprint The ticket is in addition to the planned sprint work labels Jan 16, 2025
@JennaySDavis
Copy link
Contributor Author

720 Acceptance Criteria

Pass/Fail Description
Pass Regression Testing Training Website

Comments/Additional Notes
N/A

ADA Compliance (Automated scan via Chrome Lighthouse)

Criteria Score
Performance 97
Accessibility 100
Best Practices 100

Passed 01/17/2025 - JSD

@johnbeallgsa
Copy link

Thanks for showing/explaining this during Demo. Moving to Done.

felder101 added a commit that referenced this issue Jan 23, 2025
@felder101
Production Release
84cfbdf 
Sprint 47 issues includes:
Dependabot Alert: Atro CSRF Middleware Bypass (security.checkOrigin) #720
Dependabot Alert: Astro's server source code is exposed to the public if source maps are enabled #725
Update to the latest version of USWDS 3.11.0 #722
BUG: Training Report - Selecting an Agency w/o Bureau No Results Returned #728
Update SMTP to reflect GSA IT naming convention standard #736
@felder101 felder101 mentioned this issue Jan 23, 2025
Merged
felder101 added a commit that referenced this issue Jan 24, 2025
@felder101
Production Release (#743)
6f089f3 
Sprint 47 issues includes:
Dependabot Alert: Atro CSRF Middleware Bypass (security.checkOrigin) #720
Dependabot Alert: Astro's server source code is exposed to the public if source maps are enabled #725
Update to the latest version of USWDS 3.11.0 #722
BUG: Training Report - Selecting an Agency w/o Bureau No Results Returned #728
Update SMTP to reflect GSA IT naming convention standard #736
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees

@johnbeallgsa johnbeallgsa

Labels
Addition to Sprint The ticket is in addition to the planned sprint work Dependabot Alert Sprint 47
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
3 participants
@felder101 @johnbeallgsa @JennaySDavis