mosaic/stack
1
0
Fork 0
Code Issues 10 Pull Requests Actions Packages Projects Releases 2 Wiki Activity

fix(api): resolve CSRF guard ordering with global AuthGuard (#514)
All checks were successful
ci/woodpecker/push/api Pipeline was successful
Details

Browse Source 
Co-authored-by: Jason Woltje <jason@diversecanvas.com>
Co-committed-by: Jason Woltje <jason@diversecanvas.com>
This commit was merged in pull request #514.
This commit is contained in:
Jason Woltje
2026-02-26 02:26:02 +00:00
committed by jason.woltje
parent 374ca7ace3
commit 9f4de1682f
2 changed files with 26 additions and 24 deletions
Download Patch File Download Diff File Expand all files Collapse all files

10
apps/api/src/common/guards/csrf.guard.spec.ts
View File

@@ -174,17 +174,19 @@ describe("CsrfGuard", () => {
});
describe("Session binding validation", () => {
it("should reject when user is not authenticated", () => {
it("should allow when user context is not yet available (global guard ordering)", () => {
// CsrfGuard runs as APP_GUARD before per-controller AuthGuard,
// so request.user may not be populated. Double-submit cookie match
// is sufficient protection in this case.
const token = generateValidToken("user-123");
const context = createContext(
"POST",
{ "csrf-token": token },
{ "x-csrf-token": token },
false
// No userId - unauthenticated
// No userId - AuthGuard hasn't run yet
);
expect(() => guard.canActivate(context)).toThrow(ForbiddenException);
expect(() => guard.canActivate(context)).toThrow("CSRF validation requires authentication");
expect(guard.canActivate(context)).toBe(true);
});
it("should reject token from different session", () => {