Tag: Origin-header fallback

New CSRF approach uses Sec-Fetch-Site header instead of tokens

TL;DR A Microdot maintainer replaced a token-based CSRF plan with a simpler method that relies on the browser-sent Sec-Fetch-Site header,…