sneak/upaas
1
0
Fork 0
Code Issues 14 Pull Requests 2 Actions Packages Projects Releases Wiki Activity

Add API CSRF protection via X-Requested-With header (closes #112) #116

Closed
clawbot wants to merge 1 commits from fix/112-api-csrf-protection into main
pull from: fix/112-api-csrf-protection
merge into: sneak:main
Conversation 1 Commits 1 Files Changed 4 +116 -3

1 Commits

Author SHA1 Message Date
user
efa8f51310 Add API CSRF protection via X-Requested-With header (closes #112)
All checks were successful
Check / check (pull_request) Successful in 11m36s
Details 
- Add APICSRFProtection middleware requiring X-Requested-With header on
  state-changing API requests (POST, PUT, DELETE, PATCH)
- Apply middleware to all /api/v1 routes
- Upgrade session cookie SameSite from Lax to Strict (defense-in-depth)
- Add X-Requested-With to CORS allowed headers
- Add tests for the new middleware

Browsers cannot send custom headers cross-origin without CORS preflight,
which effectively blocks CSRF attacks via cookie-based session auth.
 2026-02-20 05:33:33 -08:00