Skip to content

Add CSRF tokens to JWT edit forms#3791

Merged
lunkwill42 merged 1 commit intomasterfrom
chore/csrf-token-in-jwt
Feb 13, 2026
Merged

Add CSRF tokens to JWT edit forms#3791
lunkwill42 merged 1 commit intomasterfrom
chore/csrf-token-in-jwt

Conversation

@lunkwill42
Copy link
Copy Markdown
Member

Scope and purpose

The JWT revocation and recreation buttons used forms that did not include CSRF tokens. This adds tokens to the forms so they will continue to work when CSRF tokens are enforced.

This should be the last blocker for #3396.

Contributor Checklist

Every pull request should have this checklist filled out, no matter how small it is.
More information about contributing to NAV can be found in the
Hacker's guide to NAV.

  • Added a changelog fragment for towncrier
  • Added/amended tests for new/changed code
  • Added/changed documentation
  • Linted/formatted the code with ruff, easiest by using pre-commit
  • Wrote the commit message so that the first line continues the sentence "If applied, this commit will ...", starts with a capital letter, does not end with punctuation and is 50 characters or less long. See https://cbea.ms/git-commit/
  • Based this pull request on the correct upstream branch: For a patch/bugfix affecting the latest stable version, it should be based on that version's branch (<major>.<minor>.x). For a new feature or other additions, it should be based on master.
  • If applicable: Created new issues if this PR does not fix the issue completely/there is further work to be done
  • If it's not obvious from a linked issue, described how to interact with NAV in order for a reviewer to observe the effects of this change first-hand (commands, URLs, UI interactions)
  • If this results in changes in the UI: Added screenshots of the before and after
  • If this adds a new Python source code file: Added the boilerplate header to that file

The JWT revocation and recreation buttons used forms that did not
include CSRF tokens.  This adds tokens to the forms so they will
continue to work when CSRF tokens are enforced.
@lunkwill42 lunkwill42 requested review from a team and stveit February 13, 2026 11:09
@lunkwill42 lunkwill42 self-assigned this Feb 13, 2026
@sonarqubecloud
Copy link
Copy Markdown

@lunkwill42 lunkwill42 added nonews No news fragment is necessary for this PR (e.g. refactoring, cleanups, workflow/development changes) csrf labels Feb 13, 2026
@lunkwill42 lunkwill42 merged commit a429e40 into master Feb 13, 2026
17 of 18 checks passed
@lunkwill42 lunkwill42 deleted the chore/csrf-token-in-jwt branch February 13, 2026 11:14
@codecov
Copy link
Copy Markdown

codecov bot commented Feb 13, 2026

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 63.32%. Comparing base (33343e0) to head (c46b689).
⚠️ Report is 7 commits behind head on master.

Additional details and impacted files
@@           Coverage Diff           @@
##           master    #3791   +/-   ##
=======================================
  Coverage   63.32%   63.32%           
=======================================
  Files         619      619           
  Lines       45873    45873           
  Branches       43       43           
=======================================
  Hits        29051    29051           
  Misses      16812    16812           
  Partials       10       10           

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:
  • ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
  • 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

csrf nonews No news fragment is necessary for this PR (e.g. refactoring, cleanups, workflow/development changes)

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants