{"record":{"id":"0aebb6af6cfa23cf","repo":"odysseus-dev/odysseus","slug":"cross-site-request-rejected","errorCode":null,"errorMessage":"Cross-site request rejected","messagePattern":"Cross-site request rejected","errorType":"http","errorClass":"HTTPException","httpStatus":403,"severity":"error","filePath":"routes/shell_routes.py","lineNumber":75,"sourceCode":"    if not auth_manager:\n        # No auth at all — only safe in fully-trusted localhost dev mode\n        return\n    user = getattr(request.state, \"current_user\", None)\n    # In-process tool loopback. The AuthMiddleware already validated the\n    # internal token + loopback client before setting this marker, so\n    # honour it here as admin-equivalent.\n    if user == INTERNAL_TOOL_USER:\n        return\n    if not user or user == \"api\":\n        raise HTTPException(403, \"Admin only\")\n    if not auth_manager.is_admin(user):\n        raise HTTPException(403, \"Admin only\")\n\n\ndef _reject_cross_site(request: Request):\n    \"\"\"Reject browser cross-site navigations to shell-touching endpoints.\"\"\"\n    if request.headers.get(\"sec-fetch-site\") == \"cross-site\":\n        raise HTTPException(403, \"Cross-site request rejected\")\n\n\n_SSH_PORT_RE = re.compile(r\"^\\d{1,5}$\")\n_SAFE_VENV_RE = re.compile(r\"^[A-Za-z0-9_./~-]+$\")\n\n\ndef _ssh_base_argv(host: str, ssh_port: str | None) -> list[str]:\n    \"\"\"Build an ssh argv prefix for remote probes without local-shell parsing.\"\"\"\n    if not host or not str(host).strip() or str(host).lstrip().startswith(\"-\"):\n        raise ValueError(\"invalid ssh host\")\n    argv = [\"ssh\", \"-o\", \"ConnectTimeout=6\", \"-o\", \"StrictHostKeyChecking=no\"]\n    if ssh_port and str(ssh_port).strip() not in (\"\", \"22\"):\n        port = str(ssh_port).strip()\n        if not _SSH_PORT_RE.match(port) or not (1 <= int(port) <= 65535):\n            raise ValueError(\"invalid ssh port\")\n        argv += [\"-p\", port]\n    argv.append(str(host).strip())\n    return argv","sourceCodeStart":57,"sourceCodeEnd":93,"githubUrl":"https://github.com/odysseus-dev/odysseus/blob/f9235ebbf13f693a6fd29ce70b097f6ec83705bf/routes/shell_routes.py#L57-L93","documentation":"Error \"Cross-site request rejected\" thrown in odysseus-dev/odysseus.","triggerScenarios":"Triggered when the corresponding server-side validation or runtime check at the recorded location rejects the request or operation and returns this error message to the caller.","commonSituations":"See trigger scenarios.","solutions":["Send the request from the same origin or include the proper CSRF token.","Check the client is not stripping required headers."],"exampleFix":null,"handlingStrategy":null,"validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"f9235ebbf13f693a6fd29ce70b097f6ec83705bf","analyzedAt":"2026-08-14T21:47:48.359Z","schemaVersion":2},"datasetVersion":"2026-08-15T22:17:37.221Z"}