Repository navigation
web: Cross-origin protection - #3762
Merged
bdarnell merged 10 commits intoOct 6, 2026
Merged
Conversation
Lots of doc updates
The behavior is not exactly identical (cross_origin is now called a little later in the process, after first-line same-origin checks have failed), but since this method was used to expand access rather than restrict it it should be functionally equivalent.
Tests: - web: Sec-Fetch-Site none/same-site, precedence of Sec-Fetch-Site over Origin, trusted_origins (both paths, exact matching), null Origin, Referer not consulted, safe vs unsafe methods, setting disabled by default, check_origin overrides, interaction with xsrf_cookies, and ErrorHandler returning 404/417 instead of 403. - websocket: xsrf_cookies does not apply to websockets, trusted_origins, Sec-Fetch-Site handling, check_origin override, and mixed-case Upgrade headers not bypassing the origin check. Docs: - Restore the security warning and examples in check_origin's docstring that were dropped when it moved from WebSocketHandler. - Fix stale references to xsrf_protection and check_trusted_origin, and the link to Go's CrossOriginProtection. - Document that websockets always use these checks, and that requests without Sec-Fetch-Site or Origin are allowed. - Move trusted_origins to its alphabetical place in the settings list. Also replace the separate urlparse import with urllib.parse.urlsplit. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01USrW1MXy2Ea3H3S1ZHyPjw
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This branch implements cross-origin protection based on fetch-metadata/sec-fetch-site. The naming and algorithm follows that used by Go. This is intended to become the main method of XSRF protection for tornado and I plan to turn it on by default in 6.7.
Builds on @takluyver 's work in #3576
Closes #3576
Closes #3495