a89f2b72d9
The lusca CSRF implementation was breaking login and registration because the frontend doesn't fetch or send CSRF tokens. This is a structural issue that requires frontend implementation. As a pragmatic fix, this commit exempts public unauthenticated endpoints from CSRF protection: - /api/login, /api/register, /api/verify-email - /api/version, /api/registration-status, /api/health - /api/oidc/* (all OIDC authentication endpoints) - /api/feature-flags Authenticated endpoints still require CSRF tokens via lusca. Also updates csrf.js to use lusca's token generation mechanism, making it compatible with the global lusca CSRF middleware. TODO: Implement proper CSRF token handling in the frontend for enhanced security on public endpoints. |
||
|---|---|---|
| .. | ||
| auth.js | ||
| authorize.js | ||
| csrf.js | ||
| permissionCache.js | ||
| queryLogger.js | ||
| rateLimiter.js | ||