Mark/itchbox
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Add CSRF protection to forms #1

New issue
Closed
opened 2026-03-05 06:21:16 +00:00 by Mark · 6 comments
Mark commented 2026-03-05 06:21:16 +00:00
Owner
Copy link

The MVP has no form protection against CSRF attacks. All forms (upload, delete) lack CSRF tokens.

Expected behavior:

  • All POST forms should include CSRF tokens
  • Forms should validate tokens on submission

Suggested approach:

  • Add starlette-csrf middleware
  • Or implement custom CSRF middleware using cookies and form tokens
The MVP has no form protection against CSRF attacks. All forms (upload, delete) lack CSRF tokens. **Expected behavior:** - All POST forms should include CSRF tokens - Forms should validate tokens on submission **Suggested approach:** - Add `starlette-csrf` middleware - Or implement custom CSRF middleware using cookies and form tokens
Mark commented 2026-03-05 06:47:24 +00:00
Author
Owner
Copy link

This issue is still outstanding. The MVP currently has no CSRF protection on forms.

Work completed so far:

  • Added input validation and escaping
  • Added logging

Remaining: CSRF tokens need to be added to all POST forms.

This is a lower priority than authentication - for now, deploy behind a reverse proxy with auth.

This issue is still outstanding. The MVP currently has no CSRF protection on forms. **Work completed so far:** - Added input validation and escaping - Added logging **Remaining:** CSRF tokens need to be added to all POST forms. This is a lower priority than authentication - for now, deploy behind a reverse proxy with auth.
Mark commented 2026-06-20 20:48:32 +00:00
Author
Owner
Copy link

Auto-triage: needs decompose

Marked triage-approved + needs-decompose. decompose-executor will pick this up and break it into implementable sub-issues.

## Auto-triage: needs decompose Marked `triage-approved` + `needs-decompose`. decompose-executor will pick this up and break it into implementable sub-issues.
Mark commented 2026-07-08 13:37:35 +00:00
Author
Owner
Copy link

Auto-triage: needs decompose

Marked triage-approved + needs-decompose. decompose-executor will pick this up and break it into implementable sub-issues.

## Auto-triage: needs decompose Marked `triage-approved` + `needs-decompose`. decompose-executor will pick this up and break it into implementable sub-issues.
Mark commented 2026-07-08 14:06:19 +00:00
Author
Owner
Copy link

Auto-triage: needs decompose

Marked triage-approved + needs-decompose. decompose-executor will pick this up and break it into implementable sub-issues.

## Auto-triage: needs decompose Marked `triage-approved` + `needs-decompose`. decompose-executor will pick this up and break it into implementable sub-issues.
Mark commented 2026-07-08 16:06:22 +00:00
Author
Owner
Copy link

Auto-triage: needs decompose

Marked triage-approved + needs-decompose. decompose-executor will pick this up and break it into implementable sub-issues.

## Auto-triage: needs decompose Marked `triage-approved` + `needs-decompose`. decompose-executor will pick this up and break it into implementable sub-issues.
Mark 2026-07-08 16:22:44 +00:00
Mark commented 2026-08-11 18:12:22 +00:00
Author
Owner
Copy link

Bughunt follow-up: issue was closed with app/csrf.py committed but never wired in — no middleware registration, no POST validation, no hidden form fields, no CSRF tests. The protection was non-functional (verified: /upload set no cookie and accepted tokenless POSTs).

Landed the missing wiring in bda4c59 (fix: wire CSRF protection):

  • Register CsrfMiddleware on the FastAPI app
  • Validate csrf_token in /upload, /game/{slug}/update, /game/{slug}/delete
  • Hidden csrf_token fields in upload/update/delete templates
  • tests/test_csrf.py + rejection/integration tests (105 total passing)

Docs for ITCHBOX_CSRF_SECRET / ITCHBOX_CSRF_SECURE_COOKIE added in 25d1786.

Also fixed while hunting: home() pagination clamps ?page=0/negative to page 1 (was slicing from the wrong end), and update_game now rejects traversal entrypoints (../../etc/passwd) instead of rendering them into the iframe src.

Bughunt follow-up: issue was closed with app/csrf.py committed but never wired in — no middleware registration, no POST validation, no hidden form fields, no CSRF tests. The protection was non-functional (verified: /upload set no cookie and accepted tokenless POSTs). Landed the missing wiring in bda4c59 (fix: wire CSRF protection): - Register CsrfMiddleware on the FastAPI app - Validate csrf_token in /upload, /game/{slug}/update, /game/{slug}/delete - Hidden csrf_token fields in upload/update/delete templates - tests/test_csrf.py + rejection/integration tests (105 total passing) Docs for ITCHBOX_CSRF_SECRET / ITCHBOX_CSRF_SECURE_COOKIE added in 25d1786. Also fixed while hunting: home() pagination clamps ?page=0/negative to page 1 (was slicing from the wrong end), and update_game now rejects traversal entrypoints (../../etc/passwd) instead of rendering them into the iframe src.
Sign in to join this conversation.
No Branch/Tag specified
Branches Tags
main
No results found.
Labels
Clear labels   
blocked:gate-fetch

   
blocked:lint-failed

   
blocked:needs-decision

   
bug

Bug report

  
feature-request

   
in-progress

Kilo runner is actively working on this issue

  
needs-decompose

   
ops-task

   
quickfix

   
triage-approved

Approved by triage pipeline

No labels
blocked:gate-fetch
blocked:lint-failed
blocked:needs-decision
bug
feature-request
in-progress
needs-decompose
ops-task
quickfix
triage-approved
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference
Mark/itchbox#1
No description provided.