egg-security

egg-security copied to clipboard

feat: Check whether the value is legal Before setting the header

1

##### Checklist - [x] `npm test` passes - [x] tests and/or benchmarks are included - [x] documentation is changed or added - [x] commit message follows commit guidelines ##### Affected...

GuanyuChen

##### Checklist - [x] `npm test` passes - [ ] tests and/or benchmarks are included - [x] documentation is changed or added - [x] commit message follows commit guidelines #####...

hq5544

feat: csrf support check origin header with referer type

1

##### Checklist - [x] `npm test` passes - [x] tests and/or benchmarks are included - [ ] documentation is changed or added - [x] commit message follows commit guidelines #####...

anthinkingcoder

不安全地址补充

2

类似https://test.github.com\\@baidu.com这样的地址是不安全的，在domainWhiteList里添加了test.github.com之后还是会redirect，实际上跳转到了baidu.com，希望加上对pathname的过滤

TangTang25

ccbyland

egg-security中通过中间件设置一些安全头对egg-static不起作用，看起来是egg-static的中间件先执行直接响应了body, 导致 egg-security的中间件没机会执行，这个顺序有办法调整么？

10

WormGirl

https://github.com/eggjs/egg-security/pull/82 add `ipv6BlackList` and `ipv6ExceptionList` for ipv6

fengmk2