From 526a8742688ed58ae40ba1f254c2e7f1f7bbd866 Mon Sep 17 00:00:00 2001 From: grm Date: Fri, 18 Sep 2026 13:48:27 +0300 Subject: Security: Check the CSRF token on logout /logout was the one management POST without the token. A blog lives on a subdomain of the root domain, which is same-site, so SameSite=Lax does not keep the cookie off a form a blog page submits: any blogger's custom HTML could log the superadmin out at will. The logout form already carried _csrf; the handler now checks it through guardPOST. Co-Authored-By: Claude Opus 5 Claude-Session: https://claude.ai/code/session_01Sd8UPWrvyYCLj97JexNw3A --- internal/web/handlers_auth.go | 6 ++++++ 1 file changed, 6 insertions(+) (limited to 'internal/web/handlers_auth.go') diff --git a/internal/web/handlers_auth.go b/internal/web/handlers_auth.go index 708285d..5c57254 100644 --- a/internal/web/handlers_auth.go +++ b/internal/web/handlers_auth.go @@ -91,7 +91,13 @@ func (s *Server) handleLogin(w http.ResponseWriter, r *http.Request) { http.Redirect(w, r, s.landing(r, u, next), http.StatusSeeOther) } +// handleLogout ends the session. It needs the CSRF token like every other +// management POST, or any page could log the user out (a blog is same-site, +// so SameSite=Lax alone would not stop it); anonymous requests just bounce. func (s *Server) handleLogout(w http.ResponseWriter, r *http.Request) { + if currentUser(r) != nil && !s.guardPOST(w, r, 0) { + return + } auth.ClearSessionCookie(w, s.cfg.HTTPS) http.Redirect(w, r, "/webadmin", http.StatusSeeOther) } -- cgit v1.2.3