Code

Add support for CSRF tokens#5055

Code

Merged

arikfr merged 17 commits intomastergetredash/redash:masterfrom csrfgetredash/redash:csrfCopy head branch name to clipboardAug 9, 2020

+163-57

Commits

Commits on Jul 18, 2020

• add flask-wtf

  

  Omer Lachish

  committed
  bea4153

  Copy full SHA for bea4153

• add CSRF tokens to all static forms

  

  Omer Lachish

  committed
  538de85

  Copy full SHA for 538de85

• add CSRF tokens to all axios requests

  

  Omer Lachish

  committed
  3a6a776

  Copy full SHA for 3a6a776

Commits on Jul 19, 2020

• disable CSRF validation in unit tests

  

  Omer Lachish

  committed
  f8e5f7f

  Copy full SHA for f8e5f7f

• support CSRF-protected requests in *most* cypress tests

  

  Omer Lachish

  committed
  b4be6c7

  Copy full SHA for b4be6c7

Commits on Jul 20, 2020

• don't enfroce CSRF checks by default

  

  Omer Lachish

  committed
  078d5c7

  Copy full SHA for 078d5c7

• avoid CSRF enforcement in unit tests

  

  Omer Lachish

  committed
  7627334

  Copy full SHA for 7627334

• remove redundant spread

  

  Omer Lachish

  committed
  0b35716

  Copy full SHA for 0b35716

• some camel casing hiccups

  

  Omer Lachish

  committed
  3c26c80

  Copy full SHA for 3c26c80

• always yield the CSRF cookie, but avoid enforcing it if CSRF toggle is off

  

  Omer Lachish

  committed
  ed40280

  Copy full SHA for ed40280

• Restyled by prettier (#5056)

  Show description for 0b9d494
  

  restyled-io[bot]

  and

  restyled-commits

  authored
  0b9d494

  Copy full SHA for 0b9d494

Commits on Aug 3, 2020

• set a CSRF header only if cookie is present

  

  Omer Lachish

  committed
  8babdd0

  Copy full SHA for 8babdd0

• Merge branch 'csrf' of github.com:getredash/redash into csrf

  

  Omer Lachish

  committed
  dc0fce5

  Copy full SHA for dc0fce5

• enforce CSRF in CI

  

  Omer Lachish

  committed
  ff57a26

  Copy full SHA for ff57a26

Commits on Aug 9, 2020

• install lodash directly for Cypress

  

  Omer Lachish

  committed
  02d23de

  Copy full SHA for 02d23de

• install request-cookies directly for Cypress. We should probably start loading package.json deps

  

  Omer Lachish

  committed
  85a9edf

  Copy full SHA for 85a9edf

• enable CSRF support when logout and login happen within the same spec

  

  Omer Lachish

  committed
  c6800ee

  Copy full SHA for c6800ee