Skip to content

Remove csrf tokens from get requests#3563

Merged
Simrayz merged 2 commits intomasterfrom
fix/3472-remove-csrf-tokens-from-get-requests
Oct 10, 2025
Merged

Remove csrf tokens from get requests#3563
Simrayz merged 2 commits intomasterfrom
fix/3472-remove-csrf-tokens-from-get-requests

Conversation

@Simrayz
Copy link
Copy Markdown
Contributor

@Simrayz Simrayz commented Sep 26, 2025

Scope and purpose

Fixes #3472

This PR removes CSRF tokens from get method forms. The custom_crispy_templates/_form_content fragment was modified to support disabling the token input render. I went through all the identified forms with get methods in #3472, and these are the only ones that are submitted with html instead of "hijacked" by Javascript and use POST in the background.

This pull request

  • Supports disabling csrf token in _form_content partial
  • Disables csrf token in get method forms

Contributor Checklist

Every pull request should have this checklist filled out, no matter how small it is.
More information about contributing to NAV can be found in the
Hacker's guide to NAV.

  • Added a changelog fragment for towncrier
  • Added/amended tests for new/changed code
  • Added/changed documentation
  • Linted/formatted the code with ruff, easiest by using pre-commit
  • Wrote the commit message so that the first line continues the sentence "If applied, this commit will ...", starts with a capital letter, does not end with punctuation and is 50 characters or less long. See https://cbea.ms/git-commit/
  • Based this pull request on the correct upstream branch: For a patch/bugfix affecting the latest stable version, it should be based on that version's branch (<major>.<minor>.x). For a new feature or other additions, it should be based on master.
  • If applicable: Created new issues if this PR does not fix the issue completely/there is further work to be done
  • If it's not obvious from a linked issue, described how to interact with NAV in order for a reviewer to observe the effects of this change first-hand (commands, URLs, UI interactions)
  • If this results in changes in the UI: Added screenshots of the before and after
  • If this adds a new Python source code file: Added the boilerplate header to that file

@Simrayz Simrayz self-assigned this Sep 26, 2025
@sonarqubecloud
Copy link
Copy Markdown

sonarqubecloud bot commented Sep 26, 2025

Quality Gate Passed Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

@Simrayz Simrayz requested a review from a team September 26, 2025 07:38
@Simrayz Simrayz changed the title Fix/3472 remove csrf tokens from get requests Remove csrf tokens from get requests Sep 26, 2025
@github-actions
Copy link
Copy Markdown

github-actions bot commented Sep 26, 2025

Test results

    27 files      27 suites   44m 41s ⏱️
 2 526 tests  2 526 ✅ 0 💤 0 ❌
18 598 runs  18 598 ✅ 0 💤 0 ❌

Results for commit 1a535c8.

@codecov
Copy link
Copy Markdown

codecov bot commented Sep 26, 2025 •
edited
Loading

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 62.10%. Comparing base (62aa9b6) to head (1a535c8).
⚠️ Report is 325 commits behind head on master.

Additional details and impacted files 
@@            Coverage Diff             @@
##           master    #3563      +/-   ##
==========================================
- Coverage   62.11%   62.10%   -0.02%     
==========================================
  Files         611      611              
  Lines       44880    44880              
  Branches       43       43              
==========================================
- Hits        27876    27871       -5     
- Misses      16994    16999       +5     
  Partials       10       10

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:
  • ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
  • 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

@Simrayz Simrayz marked this pull request as ready for review October 1, 2025 13:53
@johannaengland johannaengland mentioned this pull request Oct 2, 2025
Merged
johannaengland
johannaengland reviewed Oct 2, 2025
View reviewed changes
Copy link
Copy Markdown
Contributor

@johannaengland johannaengland left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Looks good, but what about the other forms you found that were mentioned in #3472?

@Simrayz
Copy link
Copy Markdown
Contributor Author

Simrayz commented Oct 7, 2025

Looks good, but what about the other forms you found that were mentioned in #3472?

As far as I could tell, they were all handled by JS. I edited my comment with instances as I went along, which left only these

@Simrayz Simrayz merged commit 35ca868 into master Oct 10, 2025
19 checks passed
@Simrayz Simrayz deleted the fix/3472-remove-csrf-tokens-from-get-requests branch October 10, 2025 07:41
This was referenced Oct 21, 2025
Closed
Merged
Merged
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@johannaengland johannaengland johannaengland approved these changes

Assignees

@Simrayz Simrayz

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

Stop posting CSRF tokens in GET request URLs

2 participants

@Simrayz @johannaengland