Use sec-fetch-site for socket transports
Maintainers usually reply within 1 day
Nobody has claimed this yet.
Assessment
- Difficulty
- 5/5
- Estimated time
- Over a week
- Newbie friendliness
- 35/100
Research direction
The issue does not name files, tests, or an entry point. Start by locating the socket transport handling for check_origin and check_csrf, then compare the proposed Sec-Fetch-Site API options and their interaction. Done means an agreed API and implemented origin-validation behavior for socket transports, with coverage for the explicit override cases.
Written by the indexing model from the issue text.
Description
The Sec-Fetch-Site header will allow us to validate CSRF in a cleaner way.
- Dominant language
- Elixir
- Stars
- 23.2k
- Forks
- 3.2k
- Avg merge
- 16h 35m
- Merged PRs (30d)
- 18
Getting set up
- No Dockerfile or Docker Compose file
- No pull request template
- Read the contributing guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
More from phoenixframework/phoenix
-
Binary pushes don't work over the LongPoll transportPossibly taken @mandar1045 claimed this 1 day ago. Open
Difficulty 3/5 1-2 days Newbie friendliness 35/100
phoenixframework/phoenix#6906 ·
Maintainers usually reply within 1 day
-
Difficulty 3/5 1-2 days Newbie friendliness 56/100
phoenixframework/phoenix#6898 · 3 comments ·
Maintainers usually reply within 1 day
-
~p treats routes as static when they only start with a static directory namePossibly taken @mandar1045 claimed this 12 days ago. Open
Difficulty 3/5 1-2 days Newbie friendliness 30/100
phoenixframework/phoenix#6895 ·
Maintainers usually reply within 1 day
-
Connection: close header not sent before closing HTTP 1.1 connection when a controller raises an exceptionPossibly taken @javiergarea claimed this 41 days ago. Open
Difficulty 4/5 3-5 days Newbie friendliness 55/100
phoenixframework/phoenix#6859 ·
Maintainers usually reply within 1 day
-
Difficulty 4/5 3-5 days Newbie friendliness 55/100
phoenixframework/phoenix#6853 · 4 comments ·
Maintainers usually reply within 1 day
All issues in phoenixframework/phoenix
Similar issues
-
Bug: Table layout and date column are cut off on mobile screens on the Tournaments -> History pageOpenbug
Difficulty 2/5 1-3 hours Newbie friendliness 74/100
hexlet-codebattle/codebattle#2375 ·
-
Bug
Difficulty 2/5 1-3 hours Newbie friendliness 68/100
wintermeyer/vutuv#2388 ·
Maintainers usually reply within 1 day
-
Difficulty 2/5 1-3 hours Newbie friendliness 74/100
-
Broadcast API docs say to prepend realtime: to the topic, which breaks deliveryPossibly taken @mandar1045 claimed this 1 day ago. Open
Difficulty 1/5 Under an hour Newbie friendliness 80/100
Maintainers usually reply within 1 day
-
Difficulty 2/5 1-3 hours Newbie friendliness 72/100
phoenixframework/phoenix_live_view#4509 ·
Maintainers usually reply within 1 day