You are viewing a plain text version of this content. The canonical link for it is here.
Posted to dev@tooling.apache.org by "andrewmusselman (via GitHub)" <gi...@apache.org> on 2026/02/25 19:05:55 UTC

[I] Add Origin header validation for API endpoints (tooling-trusted-releases)

andrewmusselman opened a new issue, #786:
URL: https://github.com/apache/tooling-trusted-releases/issues/786

   **ASVS:** 3.5.2 · **CWE:** CWE-346, CWE-352 · **File:** `atr/blueprints/api.py` (lines 42–45, 84–87)
   
   ### Description
   
   The entire API blueprint is CSRF-exempt (`csrf.exempt(_BLUEPRINT)`), relying on JWT authentication and JSON content-type requirements as compensating controls. However, there is no explicit `Origin` header validation anywhere in the application. If CORS is ever misconfigured at the infrastructure layer (e.g. reverse proxy adds permissive headers), API endpoints would be exposed to cross-origin abuse.
   
   Adding Origin validation provides defense-in-depth for all CSRF-exempt routes.
   
   ### Recommended fix
   
   ```python
   ALLOWED_ORIGINS = {'https://releases.apache.org', 'https://release-test.apache.org'}
   
   @_BLUEPRINT.before_request
   async def _validate_origin() -> None:
       origin = quart.request.headers.get("Origin")
       if origin is not None and origin not in ALLOWED_ORIGINS:
           raise base.ASFQuartException("Invalid Origin", errorcode=403)
   ```


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: dev-unsubscribe@tooling.apache.org.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org


---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@tooling.apache.org
For additional commands, e-mail: dev-help@tooling.apache.org

Re: [I] Add Origin header validation for API endpoints (tooling-trusted-releases)

Posted by "dave2wave (via GitHub)" <gi...@apache.org>.
dave2wave commented on issue #786:
URL: https://github.com/apache/tooling-trusted-releases/issues/786#issuecomment-3987066808

   ChatGPT agrees that this approach is wrong and would break our API!
   
   Instead:
   ```python
   # atr/blueprints/api.py
   
   from quart import request
   
   @_BLUEPRINT.before_request
   async def _csrf_defense_in_depth() -> None:
       """
       CSRF defense-in-depth for API routes.
   
       - Primary control: explicit Authorization (JWT)
       - Browser detection: Sec-Fetch-Site enforcement (already present)
       - Origin is intentionally *not* allowlisted to preserve cross-origin API use
       """
       origin = request.headers.get("Origin")
   
       # Explicitly read Origin to make the control visible and auditable.
       # No allowlist enforcement by design (API is cross-origin).
       if origin is not None:
           pass
   ```


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: dev-unsubscribe@tooling.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org


---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@tooling.apache.org
For additional commands, e-mail: dev-help@tooling.apache.org

Re: [I] Add Origin header validation for API endpoints (tooling-trusted-releases)

Posted by "sbp (via GitHub)" <gi...@apache.org>.
sbp closed issue #786: Add Origin header validation for API endpoints
URL: https://github.com/apache/tooling-trusted-releases/issues/786


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: dev-unsubscribe@tooling.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org


---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@tooling.apache.org
For additional commands, e-mail: dev-help@tooling.apache.org

Re: [I] Add Origin header validation for API endpoints (tooling-trusted-releases)

Posted by "sbp (via GitHub)" <gi...@apache.org>.
sbp commented on issue #786:
URL: https://github.com/apache/tooling-trusted-releases/issues/786#issuecomment-3991483793

   I don't think it's worth defending against a hypothetical scenario where we proxy our own API with insecure headers. If we did, the fault would be in the proxy, not in ATR. Closing without action.


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: dev-unsubscribe@tooling.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org


---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@tooling.apache.org
For additional commands, e-mail: dev-help@tooling.apache.org