Severity: Medium
Location: internal/server/api.go:47-61, internal/auth/auth.go:76-79
The POST /api/tokens, DELETE /api/tokens/{id}, and POST /auth/logout endpoints rely on cookie-based authentication from the web UI but do not verify a CSRF token. The SameSite: Lax attribute on the cookie provides some protection (it blocks cross-site POST requests from forms in modern browsers), but this is not a complete defence:
SameSite: Lax does not protect against same-site attacks (e.g., if any subdomain of the management host is compromised).- Older browsers may not enforce
SameSite correctly.
Recommendation
Add a synchronizer token pattern (CSRF token) or require a custom request header (e.g., X-GHP-Token) for all state-changing requests from the web UI. API requests using Authorization: Bearer headers are already immune to CSRF.
Severity: Medium
Location:
internal/server/api.go:47-61,internal/auth/auth.go:76-79The
POST /api/tokens,DELETE /api/tokens/{id}, andPOST /auth/logoutendpoints rely on cookie-based authentication from the web UI but do not verify a CSRF token. TheSameSite: Laxattribute on the cookie provides some protection (it blocks cross-site POST requests from forms in modern browsers), but this is not a complete defence:SameSite: Laxdoes not protect against same-site attacks (e.g., if any subdomain of the management host is compromised).SameSitecorrectly.Recommendation
Add a synchronizer token pattern (CSRF token) or require a custom request header (e.g.,
X-GHP-Token) for all state-changing requests from the web UI. API requests usingAuthorization: Bearerheaders are already immune to CSRF.