fix(server-actions): case-insensitive origin matching for CSRF protection#1

Open

Grit03 wants to merge 21 commits intocanaryfrom

fix-88599-action-csrf-host-case

Commits on Jan 24, 2026

test(e2e): add next app that reproduces case-sensitive CSRF validation for server action
Grit03
committed
test(e2e): verify server action response successfully
Grit03
committed
test(e2e): rename csrf-validation-case-insensitive to host-match-case-insensitive
Grit03
committed
test(e2e): add domain constants for case-insensitive origin matching
Grit03
committed
test(e2e): rename host-origin case-insensitive test for consistency
Grit03
committed
fix(e2e): update ORIGIN_DOMAIN to include protocol in host matching
Grit03
committed
chore(e2e): remove redundant logging of headers in proxy function
Grit03
committed
test(e2e): use IANA reserved domain (example.com) for origin testing
Grit03
committed
fix(action-handler): correct typo in comment about missing origin header case
Grit03
committed
refactor(action-handler): make origin host lowercase explicit
Grit03
committed
test(action-handler): add tests to verify parseHostHeader lowercases hosts for normalization
Grit03
committed
fix(action-handler): ensure case-insensitive matching for Host and X-Forwarded-Host headers
Grit03
committed
refactor(action-handler): extract origin/host match helper for testability
Grit03
committed
test(action-handler): add tests for isOriginMatchingHost function
Grit03
committed
test(action-handler): add defensive origin/host case-insensitive checks
Grit03
committed
fix(action-handler): refactor and make isOriginMatchingHost defensive
Grit03
committed
test(e2e): verify allowedOrigins config performs case-insensitive comparison
Grit03
committed
test(csrf-protection): add case-insensitive checks for allowedOrigins
Grit03
committed
fix(csrf-protection): implement case-insensitive origin matching
Grit03
committed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

fix(server-actions): case-insensitive origin matching for CSRF protection#1

fix(server-actions): case-insensitive origin matching for CSRF protection#1
Grit03 wants to merge 21 commits intocanaryfrom
fix-88599-action-csrf-host-case

Commits on Jan 24, 2026

test(e2e): add next app that reproduces case-sensitive CSRF validation for server action

test(e2e): verify server action response successfully

test(e2e): rename csrf-validation-case-insensitive to host-match-case-insensitive

test(e2e): add domain constants for case-insensitive origin matching

test(e2e): rename host-origin case-insensitive test for consistency

fix(e2e): update ORIGIN_DOMAIN to include protocol in host matching

chore(e2e): remove redundant logging of headers in proxy function

test(e2e): use IANA reserved domain (example.com) for origin testing

fix(action-handler): correct typo in comment about missing origin header case

refactor(action-handler): make origin host lowercase explicit

test(action-handler): add tests to verify parseHostHeader lowercases hosts for normalization

fix(action-handler): ensure case-insensitive matching for Host and X-Forwarded-Host headers

refactor(action-handler): extract origin/host match helper for testability

test(action-handler): add tests for isOriginMatchingHost function

test(action-handler): add defensive origin/host case-insensitive checks

fix(action-handler): refactor and make isOriginMatchingHost defensive

test(e2e): verify allowedOrigins config performs case-insensitive comparison

test(csrf-protection): add case-insensitive checks for allowedOrigins

fix(csrf-protection): implement case-insensitive origin matching

Commits on Jan 25, 2026

chore(e2e): remove case-insensitive host-origin comparison tests and related files

chore(e2e): remove case-insensitive origin matching tests and related server action config