Avoid creating CSRF cookie if no CSRF token was created #30672
Merged
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This comment has been minimized.
This comment has been minimized.
gsmet
added
the
triage/needs-rebase
FroMage
approved these changes
Feb 6, 2023
stuartwdouglas
approved these changes
Feb 7, 2023
sberyozkin
force-pushed
the
csrf_authentication_failure
branch
from
5c024c2 to
3ce4924
Compare
sberyozkin
added
triage/backport?
and removed
triage/needs-rebase
This comment has been minimized.
This comment has been minimized.
|
Apologies... |
sberyozkin
force-pushed
the
csrf_authentication_failure
branch
from
3ce4924 to
dbd8554
Compare
|
✔️ The latest workflow run for the pull request has completed successfully. It should be safe to merge provided you have a look at the other checks in the summary. |
|
Should be backported to 2.x |
benkard
added a commit
to benkard/mulkcms2
that referenced
this pull request
Apr 2, 2023
This MR contains the following updates: | Package | Type | Update | Change | |---|---|---|---| | [flow-bin](https://github.com/flowtype/flow-bin) ([changelog](https://github.com/facebook/flow/blob/master/Changelog.md)) | devDependencies | minor | [`^0.199.0` -> `^0.200.0`](https://renovatebot.com/diffs/npm/flow-bin/0.199.0/0.200.0) | | [com.rometools:rome](http://rometools.com) ([source](https://github.com/rometools/rome)) | compile | minor | `1.18.0` -> `1.19.0` | | [org.postgresql:postgresql](https://jdbc.postgresql.org) ([source](https://github.com/pgjdbc/pgjdbc)) | build | patch | `42.5.3` -> `42.5.4` | | [org.jsoup:jsoup](https://jsoup.org/) ([source](https://github.com/jhy/jsoup)) | compile | patch | `1.15.3` -> `1.15.4` | | [io.quarkus:quarkus-maven-plugin](https://github.com/quarkusio/quarkus) | build | patch | `2.16.2.Final` -> `2.16.3.Final` | | [io.quarkus:quarkus-universe-bom](https://github.com/quarkusio/quarkus-platform) | import | patch | `2.16.2.Final` -> `2.16.3.Final` | --- ### Release Notes <details> <summary>flowtype/flow-bin</summary> ### [`v0.200.0`](flow/flow-bin@9618443...b6c1eb0) [Compare Source](flow/flow-bin@9618443...b6c1eb0) ### [`v0.199.1`](flow/flow-bin@05bb4e3...9618443) [Compare Source](flow/flow-bin@05bb4e3...9618443) </details> <details> <summary>rometools/rome</summary> ### [`v1.19.0`](https://github.com/rometools/rome/releases/tag/1.19.0) [Compare Source](rometools/rome@1.18.0...1.19.0) <!-- Release notes generated using configuration in .github/release.yml at 1.19.0 --> #### What's Changed ##### 🔨 Dependency Upgrades - Bump flatten-maven-plugin from 1.2.7 to 1.3.0 by [@​dependabot](https://github.com/dependabot) in rometools/rome#565 - Bump maven-bundle-plugin from 5.1.5 to 5.1.8 by [@​dependabot](https://github.com/dependabot) in rometools/rome#563 - Bump maven-dependency-plugin from 3.3.0 to 3.5.0 by [@​dependabot](https://github.com/dependabot) in rometools/rome#602 - Bump maven-deploy-plugin from 2.8.2 to 3.1.0 by [@​dependabot](https://github.com/dependabot) in rometools/rome#607 - Bump maven-jar-plugin from 3.2.2 to 3.3.0 by [@​dependabot](https://github.com/dependabot) in rometools/rome#574 - Bump maven-javadoc-plugin from 3.3.1 to 3.5.0 by [@​dependabot](https://github.com/dependabot) in rometools/rome#609 - Bump maven-scm-plugin from 1.12.2 to 1.13.0 by [@​dependabot](https://github.com/dependabot) in rometools/rome#554 - Bump assertj-core from 3.22.0 to 3.24.2 by [@​dependabot](https://github.com/dependabot) in rometools/rome#603 - Bump slf4j-api from 1.7.36 to 2.0.6 by [@​dependabot](https://github.com/dependabot) in rometools/rome#596 ##### Other Changes - Bump actions/setup-java from 3.3.0 to 3.10.0 by [@​dependabot](https://github.com/dependabot) in rometools/rome#606 - Bump logback-classic from 1.2.10 to 1.3.5 by [@​PatrickGotthard](https://github.com/PatrickGotthard) in rometools/rome#611 **Full Changelog**: rometools/rome@1.18.0...1.19.0 </details> <details> <summary>pgjdbc/pgjdbc</summary> ### [`v42.5.4`](https://github.com/pgjdbc/pgjdbc/blob/HEAD/CHANGELOG.md#​4254-2023-02-15-102104--0500) ##### Fixed fix: fix testGetSQLTypeQueryCache by searching for xid type. We used to search for box type but it is now cached. xid is not cached, this nuance is required for the test. fix OidValueCorrectnessTest BOX_ARRAY OID, by adding BOX_ARRAY to the oidTypeName map \[MR [#​2810](https://github.com/pgjdbc/pgjdbc/issues/2810)]\((https://github.com/pgjdbc/pgjdbc/pull/2810). fixes [Issue #​2804](pgjdbc/pgjdbc#2804). fix: Make sure that github CI runs tests on all [MRs #​2809](\(https://github.com/pgjdbc/pgjdbc/pull/2809\)). </details> <details> <summary>quarkusio/quarkus</summary> ### [`v2.16.3.Final`](https://github.com/quarkusio/quarkus/releases/tag/2.16.3.Final) [Compare Source](quarkusio/quarkus@2.16.2.Final...2.16.3.Final) ##### Major changes - [#​29756](quarkusio/quarkus#29756) - Support custom Flyway credentials/URL ##### Complete changelog - [#​31141](quarkusio/quarkus#31141) - Resolve roles allowed configuration expression after config setup is completed - [#​31129](quarkusio/quarkus#31129) - Fix stuck HTTP2 request when sent challenge has resumed request - [#​31125](quarkusio/quarkus#31125) - Add "keep-alive-enabled" parameter to REST client reactive - [#​31112](quarkusio/quarkus#31112) - Qute - fix assignability check when validating expressions - [#​31099](quarkusio/quarkus#31099) - Use the effective Maven project build config when initializing sources and classes paths for dev mode - [#​31092](quarkusio/quarkus#31092) - Make sure quarkus:go-offline properly supports test scoped dependencies - [#​31077](quarkusio/quarkus#31077) - Qute: regression in template extension method with byte array - [#​31076](quarkusio/quarkus#31076) - Quarkiverse: Install instead of verify - [#​31074](quarkusio/quarkus#31074) - Added quarkus-jms-spi to quarkus bom - [#​31059](quarkusio/quarkus#31059) - Path lookup must also consider interfaces - [#​31046](quarkusio/quarkus#31046) - Simplify Quarkiverse release.yml workflow - [#​31038](quarkusio/quarkus#31038) - Update Instrumentation Processor check logic to match comment - [#​31036](quarkusio/quarkus#31036) - Use CDI when accessing UserTransaction/TransactionManager in QuarkusTransaction - [#​31028](quarkusio/quarkus#31028) - Fix typo in snapstart enable config - [#​31016](quarkusio/quarkus#31016) - Re-initialize platform dependent netty classes/values at runtime - [#​30988](quarkusio/quarkus#30988) - Race condition in SmallRye Config property expansion for [@​RolesAllowed](https://github.com/RolesAllowed) value? - [#​30964](quarkusio/quarkus#30964) - Add ConfigMappings from a builder class to support full hot reload - [#​30961](quarkusio/quarkus#30961) - Error of quarkus:dev when the project.build.directory is overridden by a profile - [#​30960](quarkusio/quarkus#30960) - Register CDI Bean when ConfigMapping is marked as Unremovable - [#​30922](quarkusio/quarkus#30922) - Fix dependency parsing in JBangBuilderImpl - [#​30885](quarkusio/quarkus#30885) - Add concurrency configuration to the GitHub Action workflows - [#​30843](quarkusio/quarkus#30843) - Micrometer-Extension writes wrong URI-Tag when Path-Variables defined at Interface-Level - [#​30672](quarkusio/quarkus#30672) - Avoid creating CSRF cookie if no CSRF token was created - [#​30648](quarkusio/quarkus#30648) - Support passing filename to multipart form data output - [#​30594](quarkusio/quarkus#30594) - CSRF: exception thrown when authentication falied - [#​30570](quarkusio/quarkus#30570) - Set filename for PartItems in MultipartFormDataOutput - [#​30455](quarkusio/quarkus#30455) - Introduce `quarkus.datasource.devservices.init-script-path` - [#​29756](quarkusio/quarkus#29756) - Support custom Flyway credentials/URL - [#​29631](quarkusio/quarkus#29631) - [@​Unremovable](https://github.com/Unremovable) ConfigMapping is still removed - [#​29630](quarkusio/quarkus#29630) - Changes to configmappings not being applied during hot reload - [#​28709](quarkusio/quarkus#28709) - QuarkusTransaction does not fire [@​Initialized](https://github.com/Initialized)(TransactionScoped.class) - [#​24639](quarkusio/quarkus#24639) - configure dedicated db user for database migrations: DML-only user for datasource, but DDL user for migration - [#​23360](quarkusio/quarkus#23360) - "Request has already been read" using vertx + auth - [#​17839](quarkusio/quarkus#17839) - Invalid memory configuration for netty maxDirectMemory in native image </details> <details> <summary>quarkusio/quarkus-platform</summary> ### [`v2.16.3.Final`](quarkusio/quarkus-platform@2.16.2.Final...2.16.3.Final) [Compare Source](quarkusio/quarkus-platform@2.16.2.Final...2.16.3.Final) </details> --- ### Configuration 📅 **Schedule**: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined). 🚦 **Automerge**: Enabled. ♻ **Rebasing**: Whenever MR is behind base branch, or you tick the rebase/retry checkbox. 👻 **Immortal**: This MR will be recreated if closed unmerged. Get [config help](https://github.com/renovatebot/renovate/discussions) if that's undesired. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this MR, check this box --- This MR has been generated by [Renovate Bot](https://github.com/renovatebot/renovate). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiIzNC4yNC4wIiwidXBkYXRlZEluVmVyIjoiMzQuMjQuMCJ9-->
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Fixes #30594