Add CSRF token protection middleware to state-changing API endpoints #473

New issue

Open

opened 2026-04-10 18:53:02 -04:00 by pook · 0 comments

pook commented

2026-04-10 18:53:02 -04:00

Owner

Same pattern as contractpilot — the app uses cookies for JWT tokens. Add double-submit cookie CSRF middleware: (1) generate random CSRF token, (2) set as SameSite=Strict; Secure; HttpOnly cookie, (3) require matching X-CSRF-Token header on POST/PUT/DELETE/PATCH, (4) reject with 403 if missing. Exclude /api/billing/webhook endpoints (Stripe uses signature validation). Apply after auth middleware. Acceptance: POST without CSRF returns 403, with token succeeds, webhook endpoints unaffected.

Generated by CEO Planner (priority: 2)

Same pattern as contractpilot — the app uses cookies for JWT tokens. Add double-submit cookie CSRF middleware: (1) generate random CSRF token, (2) set as `SameSite=Strict; Secure; HttpOnly` cookie, (3) require matching `X-CSRF-Token` header on POST/PUT/DELETE/PATCH, (4) reject with 403 if missing. Exclude /api/billing/webhook endpoints (Stripe uses signature validation). Apply after auth middleware. Acceptance: POST without CSRF returns 403, with token succeeds, webhook endpoints unaffected. --- *Generated by CEO Planner (priority: 2)*