{{ message }}
Repository navigation
fix(http): enable XSRF protection for same-origin absolute URLs - #65683
Merged
Merged
Conversation
alan-agius4
added
action: review
pullapprove
Bot
requested review from
devversion,
jelbourn and
josephperrott
November 27, 2025 08:21
angular-robot
Bot
added
the
area: common/http
hybrist
approved these changes
Nov 27, 2025
This comment was marked as off-topic.
This comment was marked as off-topic.
This comment was marked as off-topic.
This comment was marked as off-topic.
josephperrott
approved these changes
Dec 1, 2025
josephperrott
left a comment
josephperrott
left a comment
Member
There was a problem hiding this comment.
LGTM
Reviewed-for: fw-security
jelbourn
approved these changes
Dec 2, 2025
jelbourn
left a comment
jelbourn
left a comment
Contributor
There was a problem hiding this comment.
LGTM
Reviewed-for: fw-security
Previously, the XSRF interceptor only added the XSRF token to requests with relative URLs. This commit updates the interceptor to also add the token to requests with absolute URLs, provided they match the current origin. Closes angular#20511
alan-agius4
force-pushed
the
xsrf-origin
branch
from
December 2, 2025 19:04
13d62d0 to
9ebd6c0
Compare
alan-agius4
added
action: merge
alan-agius4
added
action: review
devversion
approved these changes
Dec 3, 2025
alan-agius4
added
action: merge
Member
|
Oh my god @alan-agius4, you are a rock star. This issue caused so many tears across the whole ecosystem |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to subscribe to this conversation on GitHub.
Already have an account?
Sign in.
8 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Previously, the XSRF interceptor only added the XSRF token to requests with relative URLs. This commit updates the interceptor to also add the token to requests with absolute URLs, provided they match the current origin.
Closes #20511