feat(security): add CSRF token validation for state-changing requests#3248
Open
feat(security): add CSRF token validation for state-changing requests#3248
Conversation
Member
|
Thanks @vishu-bh for working on this. Heads up: PR #3134 by the maintainer also implements CSRF token validation and is significantly further along. It may make sense to coordinate to avoid duplicated effort — the maintainer's version may land first. Let me know if you'd like to focus on a different issue instead, or if there are aspects your approach covers that #3134 doesn't. |
7082bfc to
ebf674a
Compare
ed1c2d5 to
377fe64
Compare
…/PATCH requests Signed-off-by: Vishu Bhatnagar <vishu.bhatnagar@ibm.com>
Signed-off-by: Vishu Bhatnagar <vishu.bhatnagar@ibm.com>
Signed-off-by: Vishu Bhatnagar <vishu.bhatnagar@ibm.com>
Signed-off-by: Vishu Bhatnagar <vishu.bhatnagar@ibm.com>
Signed-off-by: Vishu Bhatnagar <vishu.bhatnagar@ibm.com>
23f6b86 to
92d15d8
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
🔗 Related Issue
Closes #543
📝 Summary
What does this PR do and why?
Implements a unified CSRF protection system for ContextForge and binds CSRF tokens to authenticated JWT sessions (via verified
jti). The change replaces the legacy admin‑only CSRF path with a single, consistent CSRF cookie/header across UI and API flows, backed by configurable settings. It adds middleware enforcement for unsafe methods, a/auth/csrf-tokenrefresh endpoint, and Admin UI updates (meta tags + JS injection) so forms/fetch automatically carry the CSRF header. Default exemptions are expanded for admin login/reset flows and path exemptions now support prefix matching. Tests and templates are updated to align with the unified CSRF cookie name and behavior.Key implementation points:
csrf_secret_keyand JWTjtisession binding.admin.html+admin.js./admin/login,/admin/forgot-password,/admin/reset-passwordwith prefix support.🏷️ Type of Change
🧪 Verification
make lintmake testmake coverage✅ Checklist
make black isort pre-commit)📓 Notes (optional)
Screenshots, design decisions, or additional context.