add all /fed_cm/ routes as CSRF exception - has its own mechanisms

sebadob · May 28, 2024 · 360ce46 · 360ce46
1 parent b22b0c9
commit 360ce46
Showing 1 changed file with 2 additions and 0 deletions.
diff --git a/rauthy-handlers/src/middleware/csrf_protection.rs b/rauthy-handlers/src/middleware/csrf_protection.rs
@@ -131,6 +131,8 @@ fn is_path_csrf_exception(path: &str) -> bool {
                 || path == "/pow"
                 // make it possible to fetch public keys from browsers / SPAs
                 || path.starts_with("/oidc/certs")
+                // FedCM has its own validation mechanisms
+                || path.starts_with("/fed_cm/")
                 || path.ends_with("/logo")
                 || path.starts_with("/.well-known/")
                 || path.starts_with("/auth/v1/.well-known/")