Skip to content

sameHost check with https: urls #80

Closed
@finchi

Description

@finchi

Hello,

I encountered an issue with a CDN that blocked the x-csrf-token header. Since the CDN and the requesting site have different hostnames, I was initially confused about where the problem was originating.

After reviewing the code, I found the following line and was wondering why https: is not included here:

if (!this.originalUrl.startsWith('http:')) {

Is this an oversight, or is there another reason for omitting https:?

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions