[VS-NfD] Make the CSRF origin check fail closed #189

New Issue

fable-5 · 2026-07-30T01:43:28+02:00

fable-5 commented

2026-07-30 01:43:28 +02:00

Plan reference: 20-massnahmenplan.md -> Phase 2
ADR: n/a
Effort: S (1 AT)
Depends on: —

Context

A state-changing request that presents neither Origin nor Referer
currently passes the same-origin check. An assessor reads that as a
fail-open control regardless of whether SameSite cookies happen to cover
the browser case.

Current state

apps/api/src/auth/auth.guard.ts:108–112: assertSameOrigin takes
origin ?? referer and returns early when both are absent. The comment
names the intent (non-browser clients such as curl and supertest;
SameSite cookies as the real defence).

Acceptance criteria

Mutating requests without Origin and without Referer are
rejected with 403 csrf_origin_mismatch.
A documented, deliberate exception path exists for non-browser
clients (PAT/bearer authentication), and cookie-authenticated
requests never benefit from it.
Tests: cookie-auth mutation without either header -> 403;
PAT-authenticated mutation without either header -> success;
mismatching origin -> 403 (existing behaviour, kept).
The api's own test helpers and e2e fixtures are adjusted rather than
the check weakened.
docs/architecture/security.md records the fail-closed rule.

Out of scope

CSRF tokens as a second mechanism — the origin check plus SameSite is the
chosen model.

**Plan reference:** `20-massnahmenplan.md` -> Phase 2 **ADR:** n/a **Effort:** S (1 AT) **Depends on:** — ## Context A state-changing request that presents neither `Origin` nor `Referer` currently passes the same-origin check. An assessor reads that as a fail-open control regardless of whether SameSite cookies happen to cover the browser case. ## Current state - `apps/api/src/auth/auth.guard.ts:108–112`: `assertSameOrigin` takes `origin ?? referer` and returns early when both are absent. The comment names the intent (non-browser clients such as curl and supertest; SameSite cookies as the real defence). ## Acceptance criteria - [ ] Mutating requests without `Origin` and without `Referer` are rejected with `403 csrf_origin_mismatch`. - [ ] A documented, deliberate exception path exists for non-browser clients (PAT/bearer authentication), and cookie-authenticated requests never benefit from it. - [ ] Tests: cookie-auth mutation without either header -> 403; PAT-authenticated mutation without either header -> success; mismatching origin -> 403 (existing behaviour, kept). - [ ] The api's own test helpers and e2e fixtures are adjusted rather than the check weakened. - [ ] `docs/architecture/security.md` records the fail-closed rule. ## Out of scope CSRF tokens as a second mechanism — the origin check plus SameSite is the chosen model.

fable-5 added this to the M24 — VS-NfD: security quick wins milestone 2026-07-30 01:43:28 +02:00

fable-5 added the

effort:S

vs-nfd

area:auth

labels 2026-07-30 01:43:28 +02:00

fable-5 referenced this issue from a commit

2026-07-30 09:34:46 +02:00

#189: make the CSRF origin check fail closed

fable-5 referenced this issue

2026-07-30 09:35:04 +02:00

#189: make the CSRF origin check fail closed #240