Leopoldadmin/leocrm
1
0
Fork 0
Code Issues 363 Pull Requests Actions Packages Projects Releases 1 Wiki Activity

fix: exempt /api/v1/errors from CSRF for frontend error logging

Browse Source
This commit is contained in:
Agent Zero
2026-07-26 12:24:31 +02:00
parent 808da564f3
commit b9d05e2198
1 changed files with 1 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
app/core/middleware.py
+1 -1
View File
@@ -45,7 +45,7 @@ class CSRFMiddleware(BaseHTTPMiddleware):
# 2. CSRF token validation (double-submit pattern) # 2. CSRF token validation (double-submit pattern)
# Skip CSRF token check for auth endpoints (login/password-reset) # Skip CSRF token check for auth endpoints (login/password-reset)
path = request.url.path path = request.url.path
if path.endswith("/auth/login") or path.endswith("/auth/logout") or "/password-reset" in path: if path.endswith("/auth/login") or path.endswith("/auth/logout") or "/password-reset" in path or path.endswith("/api/v1/errors") or path == "/api/v1/errors":
return await call_next(request) return await call_next(request)
csrf_header = request.headers.get("x-csrf-token") csrf_header = request.headers.get("x-csrf-token")