This change fixes a CSRF security vulnerability when using cookies for authentication in path operations with JSON payloads sent by browsers.
In versions lower than
0.65.2, FastAPI would try to read the request payload as JSON even if the
content-type header sent was not set to
application/json or a compatible JSON media type (e.g.
So, a request with a content type of
text/plain containing JSON data would be accepted and the JSON data would be extracted.
But requests with content type
text/plain are exempt from CORS preflights, for being considered Simple requests. So, the browser would execute them right away including cookies, and the text content could be a JSON string that would be parsed and accepted by the FastAPI application.
See CVE-2021-32677 for more details.
Thanks to Dima Boger for the security report! 🙇🔒
sudo dnf upgrade --enablerepo=updates-testing --advisory=FEDORA-2021-917e89c036
Please login to add feedback.