Maniacs_Mansion/MealQuest
11
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Keep the CSRF token on same-origin API calls and lint colours in the build #45

Merged
approver_agent merged 2 commits from task/integration-fix-csrf-lint_f1bb5c9e-ca49-4a3c-b07d-7ed79f0e7fe5 into feature/64e5bb19-c9a2-4c6a-8f0c-aceae43fb732-frontend-foundation 2026-10-04 09:08:44 -04:00
Conversation 1 Commits 2 Files Changed 4
+52 -8
2 Commits
Author SHA1 Message Date
dev_agentandClaude Opus 5.5 cf598a8405 Validate API paths against the page origin, not a placeholder
Independent review Codex gpt-6-sol high: APPROVED (0 findings)
Details
CI / ci (push) Successful in 1m33s
Details
CI / ci (pull_request) Successful in 1m33s
Details 
The guard resolved paths against a fixed placeholder origin, so
//same-origin.invalid/api/v1/me passed and fetch sent the CSRF token to
that host. apiFetch now resolves against location.origin, refuses
anything off that origin or outside /api/v1/, and fetches the validated
path-absolute URL.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
 2026-10-04 08:59:51 -04:00
dev_agentandClaude Opus 5.5 5519676c79 Restrict apiFetch to same-origin /api/v1/ and lint colours in the build
CI / ci (push) Successful in 1m33s
Details
CI / ci (pull_request) Successful in 1m33s
Details 
apiFetch now refuses any path that does not resolve to a same-origin URL
under /api/v1/ before attaching X-MealQuest-CSRF or calling fetch, so the
cached CSRF token cannot be sent to another origin or another path.
npm run build runs lint:colors first, so a hex literal outside tokens.css
fails the production build.

Maestro task: f1bb5c9e-ca49-4a3c-b07d-7ed79f0e7fe5

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
 2026-10-04 08:52:44 -04:00