futur.blue / pegasus
objective categorical abstract machine language personal data server
fork atom

Don't validate csrf token on account switch request

futur.blue eb87da05 c43ec295

verified
+1 -1
unified split
+1 -1
pegasus/lib/api/account_/login.ml
··· 17 17 18 18 let switch_account_handler = 19 19 Xrpc.handler (fun ctx -> 20 - match%lwt Dream.form ctx.req with 20 + match%lwt Dream.form ~csrf:false ctx.req with 21 21 | `Ok fields -> ( 22 22 let did = List.assoc_opt "did" fields in 23 23 match did with