From 147ad3b230b1d7bbcda47d9e32104fd2d8fcbe72 Mon Sep 17 00:00:00 2001 From: Nicola Murino Date: Fri, 16 Dec 2022 19:14:56 +0100 Subject: [PATCH] respect token validation mode for CSRF header Fixes #1104 Signed-off-by: Nicola Murino --- internal/httpd/middleware.go | 10 ++++++---- 1 file changed, 6 insertions(+), 4 deletions(-) diff --git a/internal/httpd/middleware.go b/internal/httpd/middleware.go index 89b012da..33b1b007 100644 --- a/internal/httpd/middleware.go +++ b/internal/httpd/middleware.go @@ -305,10 +305,12 @@ func verifyCSRFHeader(next http.Handler) http.Handler { return } - if !util.Contains(token.Audience(), util.GetIPFromRemoteAddress(r.RemoteAddr)) { - logger.Debug(logSender, "", "error validating CSRF header IP audience") - sendAPIResponse(w, r, errors.New("the token is not valid"), "", http.StatusForbidden) - return + if tokenValidationMode != tokenValidationNoIPMatch { + if !util.Contains(token.Audience(), util.GetIPFromRemoteAddress(r.RemoteAddr)) { + logger.Debug(logSender, "", "error validating CSRF header IP audience") + sendAPIResponse(w, r, errors.New("the token is not valid"), "", http.StatusForbidden) + return + } } next.ServeHTTP(w, r)