Security fixes
- 🔒 Check Content-Type request header before assuming JSON. Initial PR #2118 by @patrickkwang.
This change fixes a CSRF security vulnerability when using cookies for authentication in path operations with JSON payloads sent by browsers.
In versions lower than 0.65.2, FastAPI would try to read the request payload as JSON even if the content-type header sent was not set to application/json or a compatible JSON media type (e.g. application/geo+json).
So, a request with a content type of text/plain containing JSON data would be accepted and the JSON data would be extracted.
But requests with content type text/plain are exempt from CORS preflights, for being considered Simple requests. So, the browser would execute them right away including cookies, and the text content could be a JSON string that would be parsed and accepted by the FastAPI application.
See CVE-2021-32677 for more details.
Thanks to Dima Boger for the security report! 🙇🔒