[Security] No CSRF protection on state-mutating API routes

[RUKAYAT-CODER]

Overview

POST, PATCH, and DELETE handlers across the application (notes, bookmarks, approvals, tips) do not validate a CSRF token. If session cookies are used for authentication, a malicious page visited by an authenticated user can silently submit requests to any of these endpoints and mutate data on behalf of the victim.

Specifications

Features:

• All state-mutating API routes validate a CSRF token or use a SameSite=Strict cookie strategy
• Cross-origin requests without a valid token are rejected with HTTP 403

Tasks:

• Evaluate whether SameSite=Strict on the session cookie is sufficient
• If not, implement the double-submit cookie pattern with x-csrf-token header validation
• Add CSRF validation middleware in src/lib/csrfMiddleware.ts
• Apply it to all non-GET handlers via src/middleware.ts

Impacted Files:

• src/middleware.ts
• src/lib/csrfMiddleware.ts (new)
• src/app/api/notes/route.ts
• src/app/api/bookmarks/route.ts
• src/app/api/approvals/route.ts

Acceptance Criteria

• Cross-origin POST requests without a valid CSRF token return HTTP 403
• Same-origin requests with a valid token succeed
• Auth endpoints are exempt as they do not require a pre-existing session

[smartalee]

@smartalee has applied to work on this issue as part of the Stellar Wave Program's 6th wave.

I'm a web penetration tester and Bug Hunter at Hackerone, I would love to handle this please

ℹ️ Repo Maintainers: To accept this application, review their application or assign @smartalee to this issue.

[Mayorlay]

@Mayorlay has applied to work on this issue as part of the Stellar Wave Program's 6th wave.

Hello please This issue aligns well with my experience. I can work on it and submit a polished PR for review

ℹ️ Repo Maintainers: To accept this application, review their application or assign @Mayorlay to this issue.

[nanaabdul1172]

@nanaabdul1172 has applied to work on this issue as part of the Stellar Wave Program's 6th wave.

Hi maintainer,

I'd like to work on this issue. I can evaluate the existing authentication flow to determine whether "SameSite=Strict" provides sufficient CSRF protection or implement a robust double-submit cookie solution with "x-csrf-token" validation where needed. I'll add reusable CSRF middleware, apply it consistently to all state-mutating API routes while exempting appropriate auth endpoints, and include comprehensive tests covering valid same-origin requests and rejected cross-origin requests without a valid CSRF token.

ℹ️ Repo Maintainers: To accept this application, review their application or assign @nanaabdul1172 to this issue.

[drips-wave]

Congratulations, @smartalee! 🎉 Your application was accepted by the repo's maintainers, and the issue is due on June 30, 2026.

🧑‍💻 @smartalee: Please resolve the issue such that the repo's maintainers have enough time to review your contribution before the due date. You'll earn Points for completing the issue on-time, which will make you eligible for a share of the Stellar Wave Program's reward pool.

Warning

When opening a PR, please link it to this issue to ensure it gets tracked accurately. Points are awarded when this issue is marked as completed by the maintainer.

🤠 Repo maintainers: Please keep an eye on the contributor's progress and review their work before the due date. You can manage this issue, including adjusting its complexity and points, here.

🌊 Happy Wave 🌊