Rosa Gutierrez 7f5fa6d715 Use Sec-Fetch-Site exclusively for CSRF protection ...

And close the gap with JSON requests, which shouldn't be allowed if
Sec-Fetch-Site is 'cross-site' or 'none', only if it's empty as this
wouldn't be coming from a browser.

2025-12-12 18:37:32 +01:00

..

block_search_engine_indexing_test.rb

Robots, begone (#1812)

2025-12-02 13:35:58 -08:00

request_forgery_protection_test.rb

Use Sec-Fetch-Site exclusively for CSRF protection

2025-12-12 18:37:32 +01:00