Jason Woltje ae9ac808c1 fix(api): resolve CSRF guard ordering with global AuthGuard ...

CsrfGuard (APP_GUARD) runs before per-controller AuthGuard, so
request.user is always undefined when CSRF validates session binding.
Skip HMAC session-binding check when user context is unavailable;
the double-submit cookie pattern (cookie matches header) provides
sufficient CSRF protection on its own.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

2026-02-25 20:22:41 -06:00

..

api

fix(api): resolve CSRF guard ordering with global AuthGuard

2026-02-25 20:22:41 -06:00

coordinator

fix: eliminate apt-get from Kaniko builds, use static dumb-init binary

2026-02-16 20:06:06 -06:00

orchestrator

debug(auth): log session cookie source

2026-02-18 21:36:01 -06:00

web

fix(auth): prevent login page freeze on OAuth sign-in failure (#506)

2026-02-25 01:59:36 +00:00