[WICKET-6786] CsrfPreventionRequestCycleListener should support Fetch Metadata Request Headers

• Type: Improvement
• Status: Resolved
• Priority: Major
• Resolution: Fixed
• Affects Version/s: 9.0.0-M5, 8.8.0
• Fix Version/s: 9.1.0
• Component/s: wicket-core
• Assignee: Emond Papegaaij
• Reporter: Emond Papegaaij
• Created: 20/May/20 07:29
• Updated: 15/Aug/20 21:11
• Resolved: 07/Aug/20 20:51

Description

CsrfPreventionRequestCycleListener tries to determine the origin of a request via interpretation of the origin header and use this to block cross origin requests. The origin header however is not very reliable. For example, when a user opens a link in a new tab, the header is not sent. Fetch Metadata Request Headers (https://w3c.github.io/webappsec-fetch-metadata/) aims to solve this via a set of well defined headers. For Wicket, sec-fetch-site is the most important: same-origin is safe, none is a user opening a link via (for example) a bookmark, same-site and cross-origin should be blocked.