CSRF protection on the login and URL-generator forms (closes #93)

Conversation 0 Commits 2 Files Changed 9

+397 -31

2 Commits

Author	SHA1	Message	Date
sneak	6a753f14c4	feat: CSRF protection on the login and URL-generator forms (closes #93 ) check / check (push) Failing after 0s Details Both cookie-authenticated HTML form posts (POST / and POST /generate) now require a CSRF token via gorilla/csrf, the recorded default in GO_PACKAGE_DEFAULTS.md. The token cookie is independent of the session cookie, so it also covers the login POST, where no session exists yet (login CSRF). The token key is derived from the signing key with its own HKDF salt, so tokens survive restarts and reuse no other key material; gorilla/csrf supplies crypto/rand generation and constant-time compare. The form routes sit in a chi group behind the middleware; the hidden token field is rendered into login.html and generator.html. In local plaintext HTTP mode (debug) requests are marked plaintext so the library does not demand an https Referer or set a Secure cookie the browser would withhold; in production, behind the TLS-terminating proxy, it enforces its https Referer origin check. model: claude-opus-4-8	2026-09-21 12:57:23 +00:00
sneak	5f88dc5cfa	test: CSRF rejection/acceptance for POST / and POST /generate Failing tests (TDD) for the two cookie-authenticated HTML form posts: a POST without a CSRF token is rejected, a token that does not match the request's CSRF cookie is rejected, and a matching cookie+token succeeds. Login CSRF is covered specifically: the POST / cases carry no session, so protection rests on a token bound to a pre-session cookie. These reference production symbols not yet added (newCSRFProtect, Handlers.CSRF, the csrfProtect field), so the package does not build until the implementation lands. model: claude-opus-4-8	2026-09-21 12:57:23 +00:00

Author

SHA1

Message

Date

sneak

6a753f14c4

feat: CSRF protection on the login and URL-generator forms (closes #93 )

check / check (push) Failing after 0s

Details

Both cookie-authenticated HTML form posts (POST / and POST /generate)
now require a CSRF token via gorilla/csrf, the recorded default in
GO_PACKAGE_DEFAULTS.md. The token cookie is independent of the session
cookie, so it also covers the login POST, where no session exists yet
(login CSRF). The token key is derived from the signing key with its own
HKDF salt, so tokens survive restarts and reuse no other key material;
gorilla/csrf supplies crypto/rand generation and constant-time compare.

The form routes sit in a chi group behind the middleware; the hidden
token field is rendered into login.html and generator.html. In local
plaintext HTTP mode (debug) requests are marked plaintext so the library
does not demand an https Referer or set a Secure cookie the browser
would withhold; in production, behind the TLS-terminating proxy, it
enforces its https Referer origin check.

model: claude-opus-4-8

2026-09-21 12:57:23 +00:00

sneak

5f88dc5cfa

test: CSRF rejection/acceptance for POST / and POST /generate

Failing tests (TDD) for the two cookie-authenticated HTML form posts:
a POST without a CSRF token is rejected, a token that does not match the
request's CSRF cookie is rejected, and a matching cookie+token succeeds.
Login CSRF is covered specifically: the POST / cases carry no session,
so protection rests on a token bound to a pre-session cookie.

These reference production symbols not yet added (newCSRFProtect,
Handlers.CSRF, the csrfProtect field), so the package does not build
until the implementation lands.

model: claude-opus-4-8

2026-09-21 12:57:23 +00:00

CSRF protection on the login and URL-generator forms (closes #93) #117