feat: Origin/Sec-Fetch-Site CSRF check so SSR pages are CDN-cacheable - #660

Merged

vivek7405 merged 10 commits into

mainfrom

feat/origin-csrf-cdn-cache

Jun 20, 2026

Commits on Jun 20, 2026

feat(server): Origin/Sec-Fetch-Site CSRF check, drop the token cookie
t
committed
5fc9647
feat: webjs.allowedOrigins config + opt the static apps into CDN caching
t
committed
a889b5b
docs: sync CSRF surfaces to the Origin/Sec-Fetch-Site model
t
committed
1611e93
test(e2e): assert no CSRF cookie on GET (Origin-checked model)
t
committed
e71dcf4
fix(server): drop dead webjs_csrf cache carve-out; migrate tests to origin model
t
committed
baa8337
docs(server): note the x-forwarded-host proxy-trust assumption in csrf.js
t
committed
a149cf9
docs/fix: clear remaining CSRF-cookie drift + tolerate allowlist trailing slash
t
committed
b1b7a43
test(server): refresh testing-helpers file-header comment for the origin model
t
committed
9d4bce9
test(bun): assert the Origin CSRF check + cookieless SSR over the real socket
t
committed
4c89e2a
fix(test): migrate the root ssr.test.js CSRF-cookie assertion to cookieless
t
committed
e7dc8bb