Add CSRF protection middleware to all state-changing API routes #674
Labels
No labels
agent-task
agent-task
No milestone
No project
No assignees
1 participant
Notifications
Due date
No due date set.
Dependencies
No dependencies set.
Reference
pook/compliancebot#674
Loading…
Add table
Add a link
Reference in a new issue
No description provided.
Delete branch "%!s()"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
Add csurf or custom CSRF token middleware to all POST, PUT, DELETE routes (especially /api/generate, /api/billing/checkout, /api/billing/webhook). Generate and validate CSRF tokens on session. Exempt GET, HEAD, OPTIONS. Exempt Stripe webhook endpoint since Stripe sends its own signature header. Update integration tests to include CSRF token. Acceptance: requests without valid CSRF token receive 403, all existing tests pass.
Generated by CEO Planner (priority: 3)