Rosa Gutierrez 7f5fa6d715 Use Sec-Fetch-Site exclusively for CSRF protection ...

And close the gap with JSON requests, which shouldn't be allowed if
Sec-Fetch-Site is 'cross-site' or 'none', only if it's empty as this
wouldn't be coming from a browser.

2025-12-12 18:37:32 +01:00

..

authentication.rb

Merge pull request #2086 from basecamp/harden-magic-links

2025-12-12 07:23:19 +01:00

authorization.rb

Only staff can access beta/staging

2025-11-28 15:53:58 +01:00

block_search_engine_indexing.rb

Robots, begone (#1812)

2025-12-02 13:35:58 -08:00

board_scoped.rb

Ensure only admins/creators can publish boards

2025-11-12 11:48:35 +01:00

card_scoped.rb

Use Card number as the model param

2025-11-17 09:12:41 -05:00

column_scoped.rb

Fix unauthorized column reordering

2025-12-03 13:00:49 -08:00

current_request.rb

Aesthetics

2025-10-29 13:37:14 +01:00

current_timezone.rb

Mark for upstreaming

2025-10-29 13:41:11 +01:00

day_timelines_scoped.rb

Support filter by collection in different screens

2025-08-21 14:19:13 +02:00

filter_scoped.rb

Remove unnecessary filtering code

2025-10-03 10:56:34 +02:00

request_forgery_protection.rb

Use Sec-Fetch-Site exclusively for CSRF protection

2025-12-12 18:37:32 +01:00

routing_headers.rb

Add routing header to see who served request

2025-11-17 09:12:41 -05:00

set_platform.rb

Detect platform and label the correct hotkey shortcut

2025-05-27 12:14:24 -05:00

turbo_flash.rb

Prefer templates for turbo streams in all but the very simplest cases

2025-11-02 20:20:01 +01:00

view_transitions.rb

We need to upstream this fix to turbo-rails

2025-10-29 13:47:51 +01:00