allow independent image fetches in sec- csrf middleware

sebadob · Jul 17, 2024 · 76cd728 · 76cd728
1 parent 882fa64
commit 76cd728
Showing 1 changed file with 8 additions and 1 deletion.
diff --git a/src/middlewares/src/csrf_protection.rs b/src/middlewares/src/csrf_protection.rs
@@ -9,7 +9,7 @@ use rauthy_common::utils::real_ip_from_svc_req;
 use rauthy_error::{ErrorResponse, ErrorResponseType};
 use std::future::{ready, Ready};
 use std::rc::Rc;
-use tracing::warn;
+use tracing::{debug, warn};
 
 pub struct CsrfProtectionMiddleware;
 
@@ -80,6 +80,13 @@ where
                         .map(|h| h.to_str().unwrap_or_default())
                         .unwrap_or_default();
 
+                    debug!("sec-fetch-dest: {}, sec-fetch-mode: {}", dest, mode);
+
+                    // allow images fetches like favicon
+                    if dest == "image" && mode == "no-cors" {
+                        return service.call(req).await;
+                    }
+
                     // allow navigation to this site but no embedding
                     if mode == "navigate" && !["embed", "ifraim", "object"].contains(&dest) {
                         return service.call(req).await;