package lila.security

import play.api.mvc.RequestHeader

import lila.common.HTTPRequest._

final class CSRFRequestHandler(domain: String) {

  private def logger = lila.log("csrf")

  def check(req: RequestHeader): Boolean = {
    if (isXhr(req)) true // cross origin xhr not allowed by browsers
    else if (isSafe(req) && !isSocket(req)) true
    else origin(req) match {
      case None =>
        lila.mon.http.csrf.missingOrigin()
        logger.debug(print(req))
        true
      case Some("file://") =>
        true
      case Some(o) if isSubdomain(o) =>
        true
      case Some(_) =>
        if (isSocket(req)) {
          lila.mon.http.csrf.websocket()
          logger.info(s"WS ${print(req)}")
        } else {
          lila.mon.http.csrf.forbidden()
          logger.info(print(req))
        }
        false
    }
  }

  private val topDomain = s"://$domain"
  private val subDomain = s".$domain"

  // origin = "https://lichess.org"
  // domain = "lichess.org"
  private def isSubdomain(origin: String) =
    origin.endsWith(subDomain) || origin.endsWith(topDomain)
}

package lila.security

import play.api.mvc.RequestHeader

import lila.common.HTTPRequest._

final class CSRFRequestHandler(domain: String) {

  private def logger = lila.log("csrf")

  def check(req: RequestHeader): Boolean = {
    if (isSafe(req) && !isSocket(req)) true
    else origin(req) match {
      case None =>
        lila.mon.http.csrf.missingOrigin()
        logger.debug(print(req))
        true
      case Some("file://") =>
        true
      case Some(o) if isSubdomain(o) =>
        true
      case Some(_) =>
        if (isSocket(req)) {
          lila.mon.http.csrf.websocket()
          logger.info(s"WS ${print(req)}")
        } else {
          lila.mon.http.csrf.forbidden()
          logger.info(print(req))
        }

        if (isXhr(req)) true // todo: remove if possible
        else false
    }
  }

  private val topDomain = s"://$domain"
  private val subDomain = s".$domain"

  // origin = "https://lichess.org"
  // domain = "lichess.org"
  private def isSubdomain(origin: String) =
    origin.endsWith(subDomain) || origin.endsWith(topDomain)
}

--- 
+++ 
@@ -9,7 +9,8 @@
   private def logger = lila.log("csrf")
 
   def check(req: RequestHeader): Boolean = {
-    if (isSafe(req) && !isSocket(req)) true
+    if (isXhr(req)) true // cross origin xhr not allowed by browsers
+    else if (isSafe(req) && !isSocket(req)) true
     else origin(req) match {
       case None =>
         lila.mon.http.csrf.missingOrigin()
@@ -27,9 +28,7 @@
           lila.mon.http.csrf.forbidden()
           logger.info(print(req))
         }
-
-        if (isXhr(req)) true // todo: remove if possible
-        else false
+        false
     }
   }
 
Revert "monitor csrf with x-requested-with"

This reverts commit 0e5fce6b6f5915c1827e4424c1ed36eace8f62ce. Sadly this
is required by the mobile app.
