fix: do not allow simple requests for login#4823

Open

achmelo wants to merge 11 commits into

reboot/login-csrf

Commits on Jul 16, 2026

Commits on Jul 17, 2026

pass string as body
achmelo
committed
No body present: fall back to empty bytes without setting CACHED_BODY_ATTR. Using defaultIfEmpty (rather than switchIfEmpty) guarantees the chain is filtered exactly once. chain.filter(...) returns…
achmelo
committed
Merge branch 'v3.x.x' into reboot/login-csrf
achmelo
authored

Commits on Jul 20, 2026

Commits on Jul 21, 2026