fix(api): skip CSRF for Bearer-authenticated API clients (#622)

Co-authored-by: Jason Woltje <[email protected]> Co-committed-by: Jason Woltje <[email protected]>
2026-03-01 19:06:14 +00:00
parent 559c6b3831
commit 99a4567e32
2 changed files with 16 additions and 0 deletions
@@ -57,6 +57,11 @@ export class CsrfGuard implements CanActivate {
      return true;
    }

+    const authHeader = request.headers.authorization;
+    if (typeof authHeader === "string" && authHeader.startsWith("Bearer ")) {
+      return true;
+    }
+
    // Get CSRF token from cookie and header
    const cookies = request.cookies as Record<string, string> | undefined;
    const cookieToken = cookies?.["csrf-token"];