Skip to content

CSRF Failing due to Context.Request().URL not containing host #64

@Thelvaen

Description

@Thelvaen

Describe the bug
Hello,
After playing with CSRF & HTTPS, it seems that Context.Request().URL is not correctly filled, hence failing the referrer check at that line:

			valid := sameOrigin(ctx.Request().URL, referer)

To Reproduce
Steps to reproduce the behavior:

  1. Print the Context.Request().URL.Scheme or .Host when inside a middleware

Expected behavior
We should get part of the URL depending on below schema:
scheme://host.domain:port/path/to/request

actually we're only getting the path part
/path/to/request

Screenshots
see attached screenshot if it helps
ctx.Request().URL showing the path
issue_csrf

trying to query ctx.Request().URL.Host
issue_csrf

Desktop (please complete the following information):

  • Client is running Windows 10,
  • Server is running Raspbian 10,

iris.Version

  • e.g. v12.2.0-alpha

Additional context
Add any other context about the problem here.

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions