CSRF is not skipped for HEAD requests

[HolgerHees]

In the file /apps/dav/lib/Connector/Sabre/Auth Line 173 (Function requiresCSRFCheck) we skip CSRF checks only for GET requests. Why not for HEAD requests?

I mean a HEAD request is a GET request without the BODY:

Can we add a the HEAD method here too? If yes I can create a pull request if you want.

[solracsf]

For reference please check owncloud/core#30289

[szaimen]

Is this Issue still valid? If not, please close this issue. Thanks! :)

[HolgerHees]

Hi, I checked the code and it is still valid.

[joshtrichards]

Makes sense to me. Might also be an opportunity to refactor slightly.

In the OC version, if I'm reading it right, the HEAD works, but NC did it slightly differently.