CCDM: protect against CSRF #6835
Conversation
There was a problem hiding this comment.
Reviewed 4 of 4 files at r1.
Reviewable status: 1 unresolved discussion, 0 of 1 LGTMs obtained (waiting on @manolo and @platosha)
flow-server/src/main/java/com/vaadin/flow/server/connect/auth/VaadinConnectAccessChecker.java, line 110 at r1 (raw file):
X-Requested-With
Should we have this and the header value as Java constants? And reuse them in the test as well.
There was a problem hiding this comment.
Reviewable status: 1 unresolved discussion, 0 of 1 LGTMs obtained (waiting on @platosha and @qtdzz)
flow-server/src/main/java/com/vaadin/flow/server/connect/auth/VaadinConnectAccessChecker.java, line 110 at r1 (raw file):
Previously, qtdzz (Tien Nguyen) wrote…
X-Requested-WithShould we have this and the header value as Java constants? And reuse them in the test as well.
I would not make them available in the API. Do you see another reason but tests ?
There was a problem hiding this comment.
Reviewable status:
complete! all discussions resolved, 1 of 1 LGTMs obtained (waiting on @platosha)
flow-server/src/main/java/com/vaadin/flow/server/connect/auth/VaadinConnectAccessChecker.java, line 110 at r1 (raw file):
Previously, manolo (Manuel Carrasco Moñino) wrote…
I would not make them available in the API. Do you see another reason but tests ?
Yeah. It is fair enough.
Fixes #6762
This change is