xfy 82a3c12940 feat(security): add Origin-based CSRF protection for write endpoints ...

对所有 POST/PUT/PATCH/DELETE 请求校验 Origin（回退 Referer）等于本站，
堵住 login CSRF 与未来 GET 化写接口的盲区（SameSite=Lax 覆盖不到）。

- 新增 src/api/csrf.rs：纯函数 origin 解析（不引入 url crate）+ axum 中间件
- 挂载到 upload 路由与 Dioxus app 路由（最外层，先于超时/压缩）
- APP_BASE_URL 配置可信域名；未设置时回退 Host + X-Forwarded-Proto
- GET/OPTIONS 放行；拿不到本站 origin 时放行避免误杀
- 9 个单测覆盖写方法识别、origin 标准化、默认端口省略、头解析回退

2026-06-18 13:22:59 +08:00

..

comments

perf(auth): compile email regex once via LazyLock

2026-06-18 11:25:15 +08:00

posts

perf(posts): offload Markdown rendering to spawn_blocking

2026-06-18 11:18:36 +08:00

auth.rs

perf(auth): compile email regex once via LazyLock

2026-06-18 11:25:15 +08:00

csrf.rs

feat(security): add Origin-based CSRF protection for write endpoints

2026-06-18 13:22:59 +08:00

error.rs

security: fix critical issues from repository review

2026-06-17 10:34:14 +08:00

image.rs

perf(image): remove redundant Vec clone before spawn_blocking

2026-06-18 10:10:44 +08:00

markdown.rs

refactor(markdown): unify parser options across TOC and HTML passes

2026-06-18 11:16:58 +08:00

mod.rs

feat(security): add Origin-based CSRF protection for write endpoints

2026-06-18 13:22:59 +08:00

rate_limit.rs

perf(rate-limit): use lenient bucket when client IP is unknown

2026-06-18 11:28:06 +08:00

sanitizer.rs

perf(sanitizer): staticize allowlists with LazyLock to avoid per-call allocation

2026-06-18 11:23:30 +08:00

settings.rs

refactor: 清理 clippy 提示（unwrap_or 与宏 deprecated 放行）

2026-06-16 12:40:43 +08:00

slug.rs

security: fix critical issues from repository review

2026-06-17 10:34:14 +08:00

upload.rs

perf(upload): offload GIF/WebP raw image validation to spawn_blocking

2026-06-18 11:19:34 +08:00