CSRF Allows Call Initiation and Message Delivery

@@ -130,6 +130,9 @@ export default class PlaywrightDevPage {
         const resp = await this.page.request.get(`${baseURL}/api/v4/teams/name/${defaultTeam}/channels/name/${channelName}`);
         const channel = await resp.json();
 
+        await this.page.setExtraHTTPHeaders({
+            'X-Calls-E2E': 'true',
+        });
         await this.page.goto(`${baseURL}/plugins/${pluginID}/standalone/widget.html?call_id=${channel.id}`);
         await expect(this.page.locator('#calls-widget')).toBeVisible();
         await expect(this.page.getByTestId('calls-widget-loading-overlay')).toBeHidden();

@@ -125,7 +125,7 @@ jobs:
       CONTAINER_RTCD: playwright_tests_rtcd
       CONTAINER_OFFLOADER: playwright_tests_offloader
       IMAGE_CALLS_OFFLOADER: mattermost/calls-offloader:v0.9.3
-      IMAGE_CALLS_RECORDER: mattermost/calls-recorder:v0.8.6
+      IMAGE_CALLS_RECORDER: mattermost/calls-recorder:v0.8.8
       IMAGE_CALLS_TRANSCRIBER: mattermost/calls-transcriber:v0.7.1
       IMAGE_SERVER: mattermostdevelopment/mattermost-enterprise-edition:master
       IMAGE_CURL: curlimages/curl:8.7.1

@@ -716,7 +716,7 @@
   "props": {
     "min_rtcd_version": "v0.17.0",
     "min_offloader_version": "v0.9.0",
-    "calls_recorder_version": "v0.8.6",
+    "calls_recorder_version": "v0.8.8",
     "calls_transcriber_version": "v0.7.1"
   }
 }

@@ -8,7 +8,9 @@ import (
 	"errors"
 	"fmt"
 	"net/http"
+	"net/url"
 	"path/filepath"
+	"strings"
 
 	"golang.org/x/time/rate"
 
@@ -284,6 +286,40 @@ func (p *Plugin) handleDismissNotification(w http.ResponseWriter, r *http.Reques
 }
 
 func (p *Plugin) handleServeStandalone(w http.ResponseWriter, r *http.Request) {
+	// Referrer-based CSRF protection
+	referrer := r.Header.Get("Referer")
+	userAgent := r.UserAgent()
+
+	// Allow desktop or recorder (which uses our custom recorder header), or E2E
+	isDesktopApp := strings.Contains(userAgent, "Mattermost") && strings.Contains(userAgent, "Electron")
+	hasRecorderHeader := r.Header.Get("X-Calls-Recorder") == "true"
+	hasE2EHeader := r.Header.Get("X-Calls-E2E") == "true"
+	needsReferrerCheck := !(isDesktopApp || hasRecorderHeader || hasE2EHeader)
+	if needsReferrerCheck {
+		if referrer != "" {
+			// For web browsers, check referrer for CSRF protection
+			referrerURL, err := url.Parse(referrer)
+			if err != nil {
+				p.LogWarn("Serve standalone, BLOCKED: Invalid referrer", "err", err.Error())
+				http.Error(w, "Forbidden", http.StatusForbidden)
+				return
+			}
+
+			if referrerURL.Host != r.Host {
+				p.LogWarn("Serve standalone, BLOCKED: Cross-origin referrer", "from", referrerURL.Host, "to", r.Host)
+				http.Error(w, "Forbidden", http.StatusForbidden)
+				return
+			}
+
+			// Allow same-origin referrers
+		} else {
+			// No referrer - could be direct navigation (OK) or malicious site with referrer policy
+			p.LogWarn("Serve standalone, BLOCKED: no referrer")
+			http.Error(w, "Forbidden", http.StatusForbidden)
+			return
+		}
+	}
+
 	bundlePath, err := p.API.GetBundlePath()
 	if err != nil {
 		p.LogError(err.Error())