diff options
Diffstat (limited to 'cmd/dashboard')
| -rw-r--r-- | cmd/dashboard/main.go | 5 |
1 files changed, 3 insertions, 2 deletions
diff --git a/cmd/dashboard/main.go b/cmd/dashboard/main.go index 09292b4..c648ede 100644 --- a/cmd/dashboard/main.go +++ b/cmd/dashboard/main.go @@ -164,7 +164,7 @@ func main() { r.Use(sessionManager.LoadAndSave) // Session middleware must be applied globally // Initialize Claudomator reverse proxy - claudomatorProxy := handlers.NewClaudomatorProxy(cfg.ClaudomatorURL) + claudomatorProxy := handlers.NewClaudomatorProxy(cfg.ClaudomatorURL, cfg.WebAuthnOrigin) // Rate limiter for auth endpoints authRateLimiter := appmiddleware.NewRateLimiter(config.AuthRateLimitRequests, config.AuthRateLimitWindow) @@ -234,9 +234,10 @@ func main() { // GitHub webhook: no auth (GitHub POSTs with HMAC, no session) r.Post("/claudomator/api/webhooks/github", claudomatorProxy.ServeHTTP) - // All other Claudomator routes: RequireAuth only, no CSRF + // All other Claudomator routes: RequireAuth + origin check (CSRF protection for proxy) r.Group(func(r chi.Router) { r.Use(authHandlers.Middleware().RequireAuth) + r.Use(auth.OriginCheck(cfg.WebAuthnOrigin)) r.Handle("/claudomator/*", claudomatorProxy) }) |