4 people 2717c1d2e0 Security fixes (#13298) ...

* Add CSRF mitigations

This commit includes two fixes:

1. Enforce an application/json Content-Type server-side.
2. When checking the bearer token, verify that the user
   associated with the token matches the user associated
   with the cookie.

* Fix TEL-Q122-13: Access Requests Denial Of Service Via Request Reason (#125) (#127)

* Ignore input when data flow is off in TermManager

When data flow is disabled in TermManager (at the beginning or when TermManager.Off was called) we should ignore all input we receive (currently we buffer it)

* Agent forwarding socket security fix.

Co-authored-by: Lisa Kim <lisa@goteleport.com>
Co-authored-by: Joel <jwejdenstal@icloud.com>
Co-authored-by: Przemko Robakowski <przemko@przemko-robakowski.pl>

2022-06-08 18:12:45 +00:00

..

csrf

Set cookies with '__Host-' prefix

2021-03-01 22:14:10 +01:00

grpccreds.go

Session streaming

2020-09-28 23:08:56 -07:00

httpheaders.go

allow websocket connections to the same host (csp) (#7929)

2021-08-19 22:55:33 -04:00

httplib_test.go

Security fixes (#13298)

2022-06-08 18:12:45 +00:00

httplib.go

Security fixes (#13298)

2022-06-08 18:12:45 +00:00