fix(api): remove noisy CSRF guard debug log (#631)

Co-authored-by: Jason Woltje <[email protected]> Co-committed-by: Jason Woltje <[email protected]>
2026-03-01 21:13:00 +00:00
parent 2b6bed2480
commit b4f4de6f7a
1 changed files with 2 additions and 7 deletions
@@ -111,14 +111,9 @@ export class CsrfGuard implements CanActivate {

        throw new ForbiddenException("CSRF token not bound to session");
      }
-    } else {
-      this.logger.debug({
-        event: "CSRF_SKIP_SESSION_BINDING",
-        method: request.method,
-        path: request.path,
-        reason: "User context not yet available (global guard runs before AuthGuard)",
-      });
    }
+    // Note: when userId is absent, the double-submit cookie check above is
+    // sufficient CSRF protection. AuthGuard populates request.user afterward.

    return true;
  }