fix: add Tauri origins to CSRF allowlist

2026-07-20 11:02:34 -04:00
parent 5d9b629dca
commit 953a1e26e6
1 changed files with 4 additions and 1 deletions
@@ -163,7 +163,10 @@ func main() {
 		r.Group(func(r chi.Router) {
 			r.Use(middleware.Session(sessionStore, cfg))
 			r.Use(middleware.RequireAuth)
-			r.Use(middleware.CSRFProtect(cfg.Host, cfg.Port, strings.Split(os.Getenv("DUMPSTER_CSRF_ORIGINS"), ",")))
+			r.Use(middleware.CSRFProtect(cfg.Host, cfg.Port, append(
+				strings.Split(os.Getenv("DUMPSTER_CSRF_ORIGINS"), ","),
+				"tauri://localhost", "http://tauri.localhost", "https://tauri.localhost",
+			)))

 			// Auth (protected: me, update profile)
 			authHandler.RegisterProtectedRoutes(r)