b50ca99566
`parseJsonBody` and `requireJsonBody` do not require a mime type when parsing `JSON` content. This leaves them open to CSRF. They are now deprecated and `insecure` versions are added in their place. Consumers are now given a proper choice between secure and insecure functions. There is a potential attack vector in that the browser does not trigger CORS requests for "simple requests", which includes POST requests that are form or text content-types. An attacker can craft a form whose body is valid JSON, and when a user visits attacker.com and submits that form, it can be submitted to bank.com and bypass CORS. Checking the content-type is application/json prevents this, because if the content-type was set to application/json, then the browser would send a CORS request—a preflight OPTIONS request to the server asking if the current domain (and some other values) are whitelisted to send requests to that server. If the server doesn't say attacker.com is whitelisted, the browser will not send the real request to the server. |
||
|---|---|---|
| .github | ||
| demo | ||
| yesod | ||
| yesod-auth | ||
| yesod-auth-oauth | ||
| yesod-bin | ||
| yesod-core | ||
| yesod-eventsource | ||
| yesod-form | ||
| yesod-newsfeed | ||
| yesod-persistent | ||
| yesod-sitemap | ||
| yesod-static | ||
| yesod-test | ||
| yesod-websockets | ||
| .gitignore | ||
| .travis.yml | ||
| appveyor.yml | ||
| CODE_OF_CONDUCT.md | ||
| CONTRIBUTING.md | ||
| Dockerfile | ||
| LICENSE | ||
| README | ||
| README.md | ||
| ReleaseNotes.md | ||
| sources.txt | ||
| stack-lts-9.yaml | ||
| stack-persistent-2-9.yaml | ||
| stack.yaml | ||
Yesod Web Framework
An advanced web framework using the Haskell programming language. Featuring:
- safety & security guaranteed at compile time
- developer productivity: tools for all your basic web development needs
- raw performance
- fast, compiled code
- techniques for constant-space memory consumption
- asynchronous IO
- this is built in to the Haskell programming language (like Erlang)
Learn more about Yesod on its main website. If you want to get started using Yesod, we strongly recommend the quick start guide, based on the Haskell build tool stack.
Hacking on Yesod
Yesod consists mostly of four repositories:
git clone --recursive http://github.com/yesodweb/shakespeare
git clone --recursive http://github.com/yesodweb/persistent
git clone --recursive http://github.com/yesodweb/wai
git clone --recursive http://github.com/yesodweb/yesod
Each repository can be built with stack build.