Repository navigation
CSRF middleware planned before introducing any cookie-based auth #217
Description
Problem Statement. security.module.ts carries an explicit comment:
/**
* WARNING:
* If cookie-based session management or any browser-managed credentials are introduced
* in the future, CSRF protection middleware MUST be implemented.
*/There is no ticket tracking that future obligation. Re-introducing a cookie or
SameSite=None; Secure flow without realising the gap is a one-line PR away from a regression.
Why it matters. CSRF defences are only as good as their visibility. Embedding the
expectation into the source-of-truth PR queue prevents regressions.
Technical Context. Today the API is API-key-authenticated, custom-header-based, so
browsers do not auto-attach the credential. Adding cookie-parser (not currently
installed) would silently change the threat model.
Expected Outcome. An informational PR is opened that documents the existing CSRF
posture, the conditions under which it would break, and a CsrfMiddleware skeleton guarded
behind a feature flag.
Acceptance Criteria.
- A new
src/common/security/csrf.middleware.tsis registered only when
CSRF_PROTECTION_ENABLED=true. - A CI test verifies CSRF is bypassed (current posture) and a second test verifies it
blocks a forged POST when enabled. - A short
docs/security/csrf-posture.mdcovers the contract.
Implementation Notes. Use csurf/csrf-csrf packages only if still maintained; else
build a 30-line double-submit-cookie middleware to keep the dependency surface small.
Files or modules likely to be affected. src/common/security/csrf.middleware.ts,
docs/security/csrf-posture.md.
Difficulty. Medium
Estimated effort. S
Backlog item #9 from `docs/maintainer-issue-backlog.md.
Activity
Jumongweb commentedon Jul 15, 2026
Hi maintainer, i will like to solve this issue
Clement-coder commentedon Jul 20, 2026
Hi,
I’m a full-stack software and blockchain engineer with hands-on experience delivering production-ready solutions across frontend, backend, and blockchain systems.
I’d like to take ownership of this issue. I’ve reviewed the requirements and can implement a scalable, maintainable, and well-tested solution that fully satisfies the acceptance criteria.
Ready to start immediately and keep the team updated throughout the process.
YAustinXYZ commentedon Jul 21, 2026
Good morning, I wanna make this issue, i have experiencie working with this type of technologies.
ZionApprove commentedon Jul 21, 2026
assign me this.
grantfox-oss commentedon Jul 21, 2026
🦊 GrantFox — @ZionApprove has been assigned to this issue as part of the Official Campaign | FWC26 campaign!
Next steps:
Closes #217)Good luck! Track your progress on GrantFox.
fix(security): add double-submit-cookie CSRF middleware behind featur…
grantfox-oss commentedon Jul 22, 2026
🎉 This issue has been marked as completed on GrantFox as part of the Official Campaign | FWC26 campaign!
@ZionApprove's PR #405 was approved and merged by @kilodesodiq-arch.
🏆 @ZionApprove: You earned 35 FoxPoints for this contribution! Your current tier: Explorer (153 total points). Track your full progress on GrantFox.
👏 Great work, @ZionApprove! Keep contributing to ChainForgee.
fix(security): add double-submit-cookie CSRF middleware behind featur…