vrr/agent-zero
2
0
Fork 0
mirror of https://github.com/agent0ai/agent-zero.git synced 2026-05-05 23:41:49 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 4

Fix WebSocket CSRF validation failure on Chromium browsers over HTTPS

Browse source 
SameSite=Strict cookies are not sent with WebSocket upgrade requests on
Chromium-based browsers (Brave confirmed), causing the CSRF cookie
check at connect time to fail with 'csrf cookie mismatch'. This breaks
the state_sync namespace, preventing the UI from loading chats.

Change SameSite from Strict to Lax for both the Flask session cookie
and the JavaScript-set CSRF token cookie. Lax still prevents cross-site
POST CSRF while allowing same-origin WebSocket upgrades to include
cookies.

Fixes #1237
This commit is contained in:
Paolo Calvi 2026-03-11 00:00:33 +01:00
parent 5e7253282c
commit 07f94ef4b5
2 changed files with 2 additions and 2 deletions
Download patch file Download diff file Expand all files Collapse all files

2
run_ui.py
View file

@ -52,7 +52,7 @@ WerkzeugRequest.max_form_memory_size = UPLOAD_LIMIT_BYTES
webapp.config.update(
JSON_SORT_KEYS=False,
SESSION_COOKIE_NAME="session_" + runtime.get_runtime_id(), # bind the session cookie name to runtime id to prevent session collision on same host
SESSION_COOKIE_SAMESITE="Strict",
SESSION_COOKIE_SAMESITE="Lax",
SESSION_PERMANENT=True,
PERMANENT_SESSION_LIFETIME=timedelta(days=1),
MAX_CONTENT_LENGTH=int(os.getenv("FLASK_MAX_CONTENT_LENGTH", str(UPLOAD_LIMIT_BYTES))),

2
webui/js/api.js
View file

@ -219,7 +219,7 @@ export async function getCsrfToken() {
if (cookieRuntimeId) {
const _secureFlag =
window.location.protocol === "https:" ? "; Secure" : "";
document.cookie = `csrf_token_${cookieRuntimeId}=${csrfToken}; SameSite=Strict; Path=/${_secureFlag}`;
document.cookie = `csrf_token_${cookieRuntimeId}=${csrfToken}; SameSite=Lax; Path=/${_secureFlag}`;
} else {
console.warn("CSRF runtime id missing; skipping cookie name binding.");
}