web interface for table_definition improved

web/src/services/mod.rs

@@ -1,4 +1,7 @@
-use axum::http::HeaderMap;
+use axum::{
+    http::{HeaderMap, StatusCode},
+    response::{IntoResponse, Response},
+};
 use tonic::{Request, metadata::MetadataValue};
 
 #[derive(Debug)]
@@ -19,3 +22,16 @@ pub(crate) fn authenticated_request<T>(
     request.metadata_mut().insert("authorization", value);
     Ok(request)
 }
+
+/// Refuses a form POST that another site made the browser send.
+///
+/// The session cookie is `SameSite=Strict`, so a cross-site post arrives
+/// without it and fails on authentication anyway; this turns that into a plain
+/// refusal instead of a redirect to the login page, and covers every
+/// state-changing endpoint the same way.
+pub(crate) fn reject_cross_site(headers: &HeaderMap) -> Option<Response> {
+    headers
+        .get("sec-fetch-site")
+        .is_some_and(|value| value == "cross-site")
+        .then(|| (StatusCode::FORBIDDEN, "Cross-site form submission rejected").into_response())
+}