Add Sec-Fetch-Site action filter

[timkelty]

Summary

Adds a Sec-Fetch-Site action filter for opt-in CSRF replacement.

Usage

config/app.web.php

'as secFetchSite' => [
    'class' => craft\filters\SecFetchSiteFilter::class,

    // require a valid Sec-Fetch-Site header (no CSRF token fallback)
    'strict' => true,

    // allow same-site (subdomain) requests in addition to same-origin
    'allowSameSite' => false,

    'except' => [
        'graphql/*',
        'webhooks/*',
    ],
],

'as secFetchSite' => [
    'class' => craft\filters\SecFetchSiteFilter::class,

    // allow fallback to CSRF token validation when the header is missing/invalid
    'strict' => false,

    // allow same-site (subdomain) requests in addition to same-origin
    'allowSameSite' => true,
],

Links

• Fixes https://linear.app/craftcms/issue/CMS-1931
• Laravel PR: [13.x] Add origin verification to request forgery protection laravel/framework#58400
• Tempest PR: refactor(http)!: improve session management and CSRF protection tempestphp/tempest-framework#1829

[linear]

CMS-1931 Support`Sec-Fetch-Site` header