Nette 3.4 introduces a new `isFrom()` API that leverages browser-native `Sec-Fetch-*` headers to provide automatic CSRF protection without tokens, hidden fields, or session state. These headers, now broadly supported since Safari 16.4 (March 2023), tell the server the origin and intent of every request — and cannot be spoofed by JavaScript or extensions in the victim's browser. The new approach distinguishes `SameOrigin` from `SameSite`, closing the subdomain loophole that existed with the old `_nss` cookie method. Forms and signals in Nette are automatically protected without any code changes; upgrading nette/http to 3.4 is enough to switch the internals. A cookie-based fallback remains for older iOS WebKit browsers. The `addProtection()` method and its CSRF tokens are now effectively obsolete and can be removed from existing forms.
Table of contents
The era of tokens and tricksSec-Fetch headers: A systemic solution at last!isFrom(): say where a request may come fromFallback for old iOSNette does it for you automaticallyThe end of addProtection()18.9K Impressions1 Comment