From 8f9d1b802c5f22f70f620a163d0f205068bcc398 Mon Sep 17 00:00:00 2001 From: Harrison Healey Date: Wed, 15 May 2024 14:53:05 -0400 Subject: [PATCH] MM-58263 Remove CSRF check from /api/v4/client_perf (#27011) We use navigator.sendBeacon to send the new metrics since it's recommended for that, but it doesn't let us set custom headers which means that we can't set the CSRF token header that we'd need to pass that check --- server/channels/api4/metrics.go | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/server/channels/api4/metrics.go b/server/channels/api4/metrics.go index e66381e439..cc005dec6d 100644 --- a/server/channels/api4/metrics.go +++ b/server/channels/api4/metrics.go @@ -11,7 +11,7 @@ import ( ) func (api *API) InitClientPerformanceMetrics() { - api.BaseRoutes.APIRoot.Handle("/client_perf", api.APISessionRequired(submitPerformanceReport)).Methods("POST") + api.BaseRoutes.APIRoot.Handle("/client_perf", api.APISessionRequiredTrustRequester(submitPerformanceReport)).Methods("POST") } func submitPerformanceReport(c *Context, w http.ResponseWriter, r *http.Request) {