When using http.CrossOriginProtection, the AddInsecureBypassPattern method can unexpectedly bypass more requests than intended. CrossOriginProtection then skips validation, but forwards the original request path, which may be served by a different handler without the intended security protections.
Affected Software
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Golang-1.23 | Ubuntu | plucky | * |
| Golang-1.24 | Ubuntu | plucky | * |