Add CSRF protection middleware for cookie-based session auth #990

New issue

Open

opened 2026-04-12 07:03:43 -04:00 by pook · 0 comments

pook commented

2026-04-12 07:03:43 -04:00

Owner

Add CSRF token protection to all state-changing endpoints (POST, PUT, DELETE, PATCH) under /api/*.

Context: The app uses cookie-based sessions (session regeneration issue #963 confirms this). Without CSRF protection, authenticated users can be tricked into making unintended state-changing requests. This is the same vulnerability class as contractpilot's CSRF issue.

Acceptance criteria:

Install csrf-csrf or equivalent package
Generate CSRF token on session creation, expose via GET /api/auth/csrf-token
Add validation middleware on all POST/PUT/DELETE/PATCH routes under /api/*
Skip CSRF validation for /api/auth/login, /api/auth/register
Skip CSRF validation for Stripe webhook endpoint (uses signature verification via PR #759)
Return 403 with clear error when CSRF token missing or invalid
Add tests: valid token passes, missing token returns 403, invalid token returns 403
Do NOT modify existing route handlers

Generated by CEO Planner (priority: 2)

Add CSRF token protection to all state-changing endpoints (POST, PUT, DELETE, PATCH) under /api/*. Context: The app uses cookie-based sessions (session regeneration issue #963 confirms this). Without CSRF protection, authenticated users can be tricked into making unintended state-changing requests. This is the same vulnerability class as contractpilot's CSRF issue. Acceptance criteria: - Install `csrf-csrf` or equivalent package - Generate CSRF token on session creation, expose via GET /api/auth/csrf-token - Add validation middleware on all POST/PUT/DELETE/PATCH routes under /api/* - Skip CSRF validation for /api/auth/login, /api/auth/register - Skip CSRF validation for Stripe webhook endpoint (uses signature verification via PR #759) - Return 403 with clear error when CSRF token missing or invalid - Add tests: valid token passes, missing token returns 403, invalid token returns 403 - Do NOT modify existing route handlers --- *Generated by CEO Planner (priority: 2)*