Differences From Artifact [375f4721c5]:

• File src/main.c — part of check-in [88a402fe2a] at 2023-09-18 13:18:41 on branch csrf-defense-enhancement — Try to simplify and rationalize the defenses against cross-site request forgery attacks. A hodgepodge of techniques have been used in the past. This changes attempts to make everything work more alike and to centralize CSRF defenses for easier auditing. (user: drh size: 129432)

To Artifact [7b5128c41f]:

• File src/main.c — part of check-in [ff3746c4c2] at 2023-09-18 14:13:38 on branch csrf-defense-enhancement — Stronger CSRF token based on a SHA1 hash of the login cookie. (user: drh size: 129432) [more...]

254
255
256
257
258
259
260
261
262
263
264
265
266
267
268

#ifdef FOSSIL_ENABLE_TCL
  /* all Tcl related context necessary for integration */
  struct TclContext tcl;
#endif

  /* For defense against Cross-site Request Forgery attacks */
  char zCsrfToken[12];    /* Value of the anti-CSRF token */
  int okCsrf;             /* -1:  unsafe
                          **  0:  unknown
                          **  1:  same origin
                          **  2:  same origin + is POST
                          **  3:  same origin, POST, valid csrf token */

  int parseCnt[10];       /* Counts of artifacts parsed */

|

254
255
256
257
258
259
260
261
262
263
264
265
266
267
268

#ifdef FOSSIL_ENABLE_TCL
  /* all Tcl related context necessary for integration */
  struct TclContext tcl;
#endif

  /* For defense against Cross-site Request Forgery attacks */
  char zCsrfToken[16];    /* Value of the anti-CSRF token */
  int okCsrf;             /* -1:  unsafe
                          **  0:  unknown
                          **  1:  same origin
                          **  2:  same origin + is POST
                          **  3:  same origin, POST, valid csrf token */

  int parseCnt[10];       /* Counts of artifacts parsed */