Skip to content

fix(dashboard-api): enforce SameSite=Lax on all cookies to prevent CSRF attacks - #240

Merged
yash-pouranik merged 1 commit into
geturbackend:mainfrom
Siddh2024:fix/csrf-samesite-lax
May 31, 2026
Merged

fix(dashboard-api): enforce SameSite=Lax on all cookies to prevent CSRF attacks#240
yash-pouranik merged 1 commit into
geturbackend:mainfrom
Siddh2024:fix/csrf-samesite-lax

Conversation

@Siddh2024

@Siddh2024 Siddh2024 commented May 31, 2026 •
edited by coderabbitai Bot
Loading

Copy link
Copy Markdown
Contributor

Summary

Fixes #239 - Dashboard API CSRF vulnerability

Problem

Auth middleware reads JWT from
eq.cookies.accessToken\ as primary source. The cookies were set with \SameSite=None\ in production, allowing browsers to attach them on any cross-origin request.

Solution

Changed all dashboard-api cookies to use \SameSite=Lax\ consistently across all environments. This prevents cookies from being sent on cross-origin subresource requests while still allowing top-level navigations.

Affected cookies:

  • \�ccessToken,
    efreshToken, _csrf, \dashboardGithubOauthState\

Files changed:

  • \�pps/dashboard-api/src/app.js\
  • \�pps/dashboard-api/src/controllers/auth.controller.js\

Verification

  • All 14 auth middleware tests pass

Summary by CodeRabbit

  • Bug Fixes
    • Updated authentication and CSRF protection cookie configurations to enforce consistent security settings across the application.

@Siddh2024
fix(dashboard-api): enforce SameSite=Lax on all cookies to prevent CS…
04ec4da 
…RF attacks

Changes all dashboard-api cookies from SameSite=None (production) / Lax
(development) to SameSite=Lax across all environments. This prevents
the browser from sending cookies on cross-origin subresource requests,
closing the CSRF attack vector where an external site could trigger
authenticated API calls via cookie-bearing requests.

Affected cookies:
- accessToken (auth session)
- refreshToken (auth session)
- _csrf (CSRF secret cookie)
- dashboardGithubOauthState (GitHub OAuth state)

Closes geturbackend#239
@coderabbitai

coderabbitai Bot commented May 31, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Review Change Stack

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info
⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: a1f7f530-095d-4141-9ff7-84ad09162c8b

📥 Commits

Reviewing files that changed from the base of the PR and between a8c1894 and 04ec4da.

📒 Files selected for processing (2)
  • apps/dashboard-api/src/app.js
  • apps/dashboard-api/src/controllers/auth.controller.js
📝 Walkthrough

Walkthrough

This PR updates cookie sameSite attributes to use a consistent 'lax' value across CSRF middleware and authentication flows, replacing environment-dependent configuration that previously defaulted to 'none' in production.

Changes

SameSite Cookie Hardening

Layer / File(s) Summary
CSRF middleware sameSite configuration
apps/dashboard-api/src/app.js		 CSRF middleware cookie configuration updated to hardcode sameSite='lax' for consistent cross-site cookie handling.
Auth controller sameSite configuration
apps/dashboard-api/src/controllers/auth.controller.js		 Auth controller cookie options and all auth flows (GitHub OAuth state cookie, GitHub auth startup, password reset, and logout) updated to use consistent sameSite='lax' instead of environment-dependent values.

Estimated code review effort

🎯 2 (Simple) | ⏱️ ~8 minutes

Poem

🐰 Cookies now dance in harmony,
No more production's dependency!
SameSite lax, steady and true,
CSRF guards in uniform hue. ✨

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 inconclusive)

Check name Status Explanation Resolution
Linked Issues check ❓ Inconclusive The changes partially address issue #239 by implementing SameSite=Lax protection; however, the issue suggests SameSite=strict or CSRF token validation, and only SameSite=Lax was implemented. Verify that SameSite=Lax is sufficient to prevent the described CSRF attack vector, or clarify why SameSite=strict was not chosen if that was the intended requirement.
✅ Passed checks (4 passed)
Check name Status Explanation
Description Check ✅ Passed Check skipped - CodeRabbit’s high-level summary is enabled.
Title check ✅ Passed The title accurately summarizes the main change: enforcing SameSite=Lax on all cookies to prevent CSRF attacks, which directly matches the code modifications across both files.
Out of Scope Changes check ✅ Passed All changes are directly scoped to implementing SameSite=Lax cookie protection across dashboard-api CSRF and authentication cookies as required by issue #239.
Docstring Coverage ✅ Passed No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.

✏️ Tip: You can configure your own custom pre-merge checks in the settings.

✨ Finishing Touches
🧪 Generate unit tests (beta)
  • Create PR with unit tests

Warning

There were issues while running some tools. Please review the errors and either fix the tool's configuration or disable the tool if it's a critical failure.

🔧 ESLint

If the error stems from missing dependencies, add them to the package.json file. For unrecoverable errors (e.g., due to private dependencies), disable the tool in the CodeRabbit configuration.

ESLint skipped: no ESLint configuration detected in root package.json. To enable, add eslint to devDependencies.

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

Comment @coderabbitai help to get the list of available commands and usage tips.

@yash-pouranik
yash-pouranik merged commit 87730ce into geturbackend:main May 31, 2026
8 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@yash-pouranik yash-pouranik yash-pouranik approved these changes

Assignees

No one assigned

Labels

gssoc:approved GSSOC'26 level:intermediate quality:clean type:refactor

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

Dashboard API accepts access tokens from cookies with no CSRF protection

2 participants

@Siddh2024 @yash-pouranik