Revert "Add header check for CSRF"

This reverts commit a749ac73ac.
This commit is contained in:
Omar Roth 2018-09-05 21:45:14 -05:00
parent 4f91854bd3
commit e590d39aa9

View file

@ -106,21 +106,6 @@ spawn do
end
before_all do |env|
env.response.headers["X-XSS-Protection"] = "1; mode=block;"
env.response.headers["X-Content-Type-Options"] = "nosniff"
# CSRF
if Kemal.config.ssl || CONFIG.https_only
host = env.request.headers["Host"]?
if (env.request.headers["Origin"]?.try &.== host) ||
(env.request.headers["Referer"]?.try &.== host)
# All good!
else
halt env, status_code: 403, response: "Failed CSRF check"
end
end
if env.request.cookies.has_key? "SID"
headers = HTTP::Headers.new
headers["Cookie"] = env.request.headers["Cookie"]