Secure against CSRF by feedmeapples · Pull Request #193 · temporalio/ui

feedmeapples · 2022-01-04T01:47:07Z

What was changed

Reads and sets CSRF header for all API requests

Securing against CSRF

with ui-server PR Secure aginst CSRF ui-server#83
For requests that are determined as not safe (eg. PUT, DELETE) validated that they succeed only if client sets X-CSRF-TOKEN

- lodash: ^4.17.21 -> ^4.18.1 (CVE-2026-4800, CVE-2026-2950, CVE-2025-13465) - svelte: 5.53.3 -> 5.55.1 (CVE-2026-27902, CVE-2026-27901) - @sveltejs/kit: 2.53.0 -> 2.55.0 (DoS via form deserialization) - storybook: ^8.6.11 -> ^8.6.18 (CVE-2026-27148) - tar-fs: >=2.1.2 -> ^3.1.2 (CVE-2025-59343) Resolves Dependabot alerts #233, #232, #159, #204, #203, #194, #193, #207, #192, #127.

#3269) - lodash: ^4.17.21 -> ^4.18.1 (CVE-2026-4800, CVE-2026-2950, CVE-2025-13465) - svelte: 5.53.3 -> 5.55.1 (CVE-2026-27902, CVE-2026-27901) - @sveltejs/kit: 2.53.0 -> 2.55.0 (DoS via form deserialization) - storybook: ^8.6.11 -> ^8.6.18 (CVE-2026-27148) - tar-fs: >=2.1.2 -> ^3.1.2 (CVE-2025-59343) Resolves Dependabot alerts #233, #232, #159, #204, #203, #194, #193, #207, #192, #127.

feedmeapples force-pushed the csrf branch from 425a0ed to f859d7d Compare January 4, 2022 01:49

Secure against CSRF

f29c5b3

feedmeapples force-pushed the csrf branch from f859d7d to f29c5b3 Compare January 4, 2022 02:03

feedmeapples requested a review from stevekinney January 4, 2022 02:05

stevekinney approved these changes Jan 4, 2022

View reviewed changes

feedmeapples merged commit 2cb2594 into main Jan 4, 2022

feedmeapples deleted the csrf branch January 4, 2022 15:22