Repository navigation
Conversation
The DevTools server (`server_api.dart` now has a `_validateRequest` function that performs a variety of checks to prevent cross-site request forgery and DNS rebinding: * Prevents external websites from triggering local operations through cross-origin `GET` requests. Requests to the DevTools server are now required to be `POST` or `OPTIONS`. Web browsers will allow cross-origin `GET` requests through `img` tags or the `fetch()` API. Malicious websites could call `api/notifyForVmServiceConnection` and connect to a remote VM service, which could lead to CSRF attacks where DTD authentication tokens are read through `/api/getDtdUri`. * Prevents DNS rebinding attacks by validating that the `host` header is within an allowlist of loopback addresses (`localhost`, `127.0.0.1`, etc) and is not malformed to mitigate DNS rebinding. * Rejects requests where the `Sec-Fetch-Site` header is set to `cross-site` unless the `Origin` header is a valid loopback address. Otherwise, only `same-origin`, `same-site`, or `none` are allowed.
johnpryan
requested review from
a team,
bkonyi and
kenzieschmoll
as code owners
November 9, 2026 21:00
![gemini-code-assist[bot]](https://avatars.githubusercontent.com/in/956858?s=60&v=4){kind=small}
Contributor
There was a problem hiding this comment.
Code Review
This pull request enhances the security of the DevTools server APIs by requiring POST (or OPTIONS CORS preflight) requests and validating Host, Origin, and Sec-Fetch-Site headers in ServerApi.handle to mitigate CSRF, DNS rebinding, and cross-origin attacks. It introduces a custom X-DevTools-Request header to force CORS preflight requests in browsers, updates client-side requests to include this header, and adds comprehensive test coverage for the new validation logic. There are no review comments to assess, and I have no additional feedback to provide.
srawlins
approved these changes
Nov 9, 2026
srawlins
left a comment
srawlins
left a comment
Contributor
There was a problem hiding this comment.
LGTM, nice new tests. I hate CORS stuff, but good to get right.
This branch has not been deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The DevTools server (
server_api.dart) now has a_validateRequestfunction that performs a variety of checks to prevent cross-site request forgery, DNS rebinding, and cross-origin attacks:GETrequests. Requests to the DevTools server are now required to bePOSTorOPTIONS. Web browsers will allow cross-originGETrequests throughimgtags or thefetch()API. Malicious websites could callapi/notifyForVmServiceConnectionand connect to a remote VM service, which could lead to CSRF attacks where DTD authentication tokens are read through/api/getDtdUri.hostheader is within an allowlist of loopback addresses (localhost,127.0.0.1, etc) and is not malformed to mitigate DNS rebinding.Sec-Fetch-Siteheader is set tocross-siteunless theOriginheader is a valid loopback address. Otherwise, onlysame-origin,same-site, ornoneare allowed.This makes progress towards: