fix(csrf): add per-session CSRF token to state-mutating auth requests#694
fix(csrf): add per-session CSRF token to state-mutating auth requests#694anshul23102 wants to merge 1 commit into
Conversation
POST /api/auth/login was submitted with no CSRF protection. An attacker could craft a page that silently submits the form from a third-party origin using the victim's browser session, since the browser automatically attaches session cookies to cross-origin requests. Add a csrf.ts utility that generates a cryptographically random 32-byte token via window.crypto.getRandomValues(), stores it in sessionStorage for the lifetime of the tab, and exposes csrfHeaders() for use with axios. Apply csrfHeaders() to the login POST request. The backend must validate the X-CSRF-Token header against the server-side session to complete the protection chain. Closes GitMetricsLab#689
|
Warning Review limit reached
More reviews will be available in 54 minutes and 12 seconds. Learn how PR review limits work. Your organization has run out of usage credits. Purchase more in the billing tab. ⌛ How to resolve this issue?After more reviews become available, a review can be triggered using the We recommend that you space out your commits to avoid hitting the rate limit. 🚦 How do rate limits work?CodeRabbit enforces hourly rate limits for each developer per organization. Our paid plans include higher PR review limits than trial, open-source, and free plans. In all cases, reviews become available again over time. During sustained high-volume PR review activity, CodeRabbit may temporarily slow when the next review becomes available. Please see our Fair Usage Limits Policy for further information. ℹ️ Review info⚙️ Run configurationConfiguration used: defaults Review profile: CHILL Plan: Pro Run ID: 📒 Files selected for processing (2)
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
github-actions
Bot
added
gssoc:approved
level:intermediate
quality:clean
type:accessibility
labels
✅ Deploy Preview for github-spy ready!
To edit notification comments on pull requests, go to your Netlify project configuration. |
1 participant
Description
The POST /api/auth/login form submission carried no CSRF protection. A malicious third-party page could submit the login form cross-origin using the victim's active browser session, since the browser automatically attaches session cookies to cross-origin requests.
Root Cause
No CSRF header was included in the axios.post call. The backend had no way to distinguish a legitimate user submission from a forged cross-site request.
Related Issue
Closes #689
Type of Change
Changes Made
The backend must validate the X-CSRF-Token header against the server-side session value to complete the protection chain.
Testing Done
Checklist