Expand description
Cross-site request forgery defense.
Reject state-changing requests whose Origin (or, failing that,
Referer) does not match the configured public base URL. The session
cookie uses SameSite=Lax, which on its own does not block same-site
sub-resource requests nor multipart form submissions from a third-party
origin, so cookie-authenticated routes need this second layer of defence.
Functionsยง
- require_
same_ origin - Middleware that enforces same-origin policy on state-changing requests.