---

ASA-202107-6 - log back

ASA-202107-6 edited at 03 Jul 2021 16:26:07

Workaround

- To mitigate the issue, it would be possible to add a middleware or a dependency that checks the content-type header and aborts the request if it is not application/json or another JSON compatible content type. + To mitigate the issue, it would be possible to add a middleware or a + dependency that checks the content-type header and aborts the request + if it is not application/json or another JSON compatible content type.

ASA-202107-6 edited at 01 Jul 2021 12:46:53
Impact	- A remote attacker could perform cross-origin request forgery attacks on FastAPI applications accepting JSON payloads. + A remote attacker could perform cross-origin request forgery (CSRF) attacks on FastAPI applications accepting JSON payloads.

ASA-202107-6 edited at 01 Jul 2021 12:38:26
Workaround	+ To mitigate the issue, it would be possible to add a middleware or a dependency that checks the content-type header and aborts the request if it is not application/json or another JSON compatible content type.
Impact	+ A remote attacker could perform cross-origin request forgery attacks on FastAPI applications accepting JSON payloads.

ASA-202107-6 created at 01 Jul 2021 12:35:15