[Agent] Issue #473: same pattern as contractpilot the app us #476

Closed

pook wants to merge 50 commits from feat/csrf-double-submit into main

pook commented

2026-04-10 19:09:47 -04:00

Owner

Closes #473

Changes

feat: issue #473 same-pattern-as-contractpilot-the-app-us (agent task liancebot473)

Acceptance Criteria

Same pattern as contractpilot — the app uses cookies for JWT tokens. Add double-submit cookie CSRF middleware: (1) generate random CSRF token, (2) set as SameSite=Strict; Secure; HttpOnly cookie, (3) require matching X-CSRF-Token header on POST/PUT/DELETE/PATCH, (4) reject with 403 if missing. Exclude /api/billing/webhook endpoints (Stripe uses signature validation). Apply after auth middleware. Acceptance: POST without CSRF returns 403, with token succeeds, webhook endpoints unaffected.

Generated by CEO Planner (priority: 2)

Tokens: 44 in / 9803 out

Closes #473 ## Changes feat: issue #473 same-pattern-as-contractpilot-the-app-us (agent task liancebot473) ## Acceptance Criteria Same pattern as contractpilot — the app uses cookies for JWT tokens. Add double-submit cookie CSRF middleware: (1) generate random CSRF token, (2) set as `SameSite=Strict; Secure; HttpOnly` cookie, (3) require matching `X-CSRF-Token` header on POST/PUT/DELETE/PATCH, (4) reject with 403 if missing. Exclude /api/billing/webhook endpoints (Stripe uses signature validation). Apply after auth middleware. Acceptance: POST without CSRF returns 403, with token succeeds, webhook endpoints unaffected. --- *Generated by CEO Planner (priority: 2)* Tokens: 44 in / 9803 out

pook added 2 commits

2026-04-10 19:09:47 -04:00

Add double-submit cookie CSRF protection middleware d3be70690b

Protects POST/PUT/DELETE/PATCH endpoints against cross-site request forgery
using the double-submit cookie pattern with timing-safe token comparison.
Stripe webhook endpoint is excluded since it uses its own signature validation.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>