CSRF Update

[benazeem]

Updated CSRF logic

Summary by CodeRabbit

• New Features

  • Added support for PATCH HTTP requests

• Security Enhancements

  • Enhanced CSRF protection with improved token validation and session verification
  • Implemented mandatory origin header validation for unsafe operations
  • CSRF tokens now provided in login, registration, and token refresh responses
  • Updated security cookie handling for improved protection

[coderabbitai]

Caution

Review failed

The pull request is closed.

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: 4070a02e-c0c3-44d2-bdbb-dffcdba01869

📥 Commits

Reviewing files that changed from the base of the PR and between 247fdc3 and e5cb137.

📒 Files selected for processing (9)

• src/config/corsConfig.ts
• src/middleware/security/requireCsrf.ts
• src/modules/auth/auth.controller.ts
• src/modules/auth/auth.service.ts
• src/modules/auth/utils/createSessionPayload.ts
• src/modules/user/user.controller.ts
• src/types/Auth.ts
• src/utils/generateAllCookieTokens.ts
• src/utils/tokens.ts

---

📝 Walkthrough

Walkthrough

This pull request refactors CSRF token handling across the authentication flow. CSRF tokens transition from simple hex strings to JWT-based tokens bound to sessions and users. The CSRF middleware adds strict origin/referer validation for unsafe HTTP methods. CORS configuration adds PATCH method support, and token generation logic is redistributed across auth and session modules.

Changes

Cohort / File(s)	Summary
CORS Configuration src/config/corsConfig.ts	Added PATCH to the allowed HTTP methods list in CORS configuration.
CSRF Validation Middleware src/middleware/security/requireCsrf.ts	Replaced simple string comparison with JWT-based CSRF token verification via jwt.verify(). Added strict origin/referer header validation for unsafe methods. Implemented session and user binding checks against decoded JWT claims. Removed debug logging and helper functions.
Token Generation Utilities src/utils/tokens.ts, src/utils/generateAllCookieTokens.ts, src/modules/auth/utils/createSessionPayload.ts	Changed generateCsrfToken() to accept userId and sessionId, generating JWT tokens instead of hex strings. Updated generateRefreshToken() to remove unused reduceTime parameter. Moved CSRF token generation responsibility from generateAllCookieTokens to createSessionPayload. Added CSRF token configuration constants from environment variables.
Authentication Module src/modules/auth/auth.controller.ts, src/modules/auth/auth.service.ts	Updated cookie handling: renamed csrf-token to csrf_token, set httpOnly: false, and use REFRESH_AGE for expiry. Auth controllers now include csrfToken in JSON responses. refreshTokenController requires and validates CSRF cookie presence. Removed CSRF token generation from refreshTokens() service method.
Type Definitions src/types/Auth.ts	Removed csrfToken field from RefreshTokenOutput type. SignOutput remains unchanged with CSRF token as required field.
User Module src/modules/user/user.controller.ts	Added UnauthorizedError import. Changed getProfileController to return manually constructed response instead of using sendSuccess helper.

Sequence Diagram

sequenceDiagram
    participant Client
    participant Middleware as CSRF Middleware<br/>(requireCsrf)
    participant JWT as JWT Verifier
    participant SessionStore as Session/User Store
    participant Handler as Route Handler

    Client->>Middleware: Unsafe Request<br/>(PUT/POST/DELETE/PATCH)<br/>with csrf-token header<br/>and csrf_token cookie
    
    Middleware->>Middleware: Validate origin/<br/>referer header present
    
    alt Missing origin/referer
        Middleware->>Client: 401 UnauthorizedError
    end
    
    Middleware->>Middleware: Validate origin<br/>format & allowlist
    
    alt Invalid/disallowed origin
        Middleware->>Client: 401 UnauthorizedError
    end
    
    Middleware->>Middleware: Extract CSRF token<br/>from header & cookie
    
    Middleware->>JWT: jwt.verify(token,<br/>CSRF_TOKEN_SECRET)
    
    alt JWT verification fails
        JWT->>Middleware: Error
        Middleware->>Client: 401 UnauthorizedError
    end
    
    JWT->>Middleware: Decoded payload<br/>{userId, sessionId}
    
    Middleware->>SessionStore: Verify decoded.sessionId<br/>matches req.sessionId
    
    alt Session mismatch
        Middleware->>Client: 401 UnauthorizedError
    end
    
    Middleware->>SessionStore: If present in token,<br/>verify decoded.userId<br/>equals req.user?.id
    
    alt User binding mismatch
        Middleware->>Client: 401 UnauthorizedError
    end
    
    Middleware->>Handler: next() - Token valid
    Handler->>Client: Proceed with request

Loading

Estimated code review effort

🎯 4 (Complex) | ⏱️ ~45 minutes

Possibly related PRs

• Update Cookies (Error Coming because of different domain names of fro… #21: Modifies overlapping CSRF-related code paths including middleware validation, session storage, token generation, and cookie handling for CSRF tokens.

Poem

🐰 A token's journey, JWT-bound and true,
Sessions and users now verified through,
No more hex whispers, just claims in the air—
Origins checked with meticulous care! ✨

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch API-LogicBuilding

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[Copilot]

Pull request overview

This PR updates the CSRF implementation by moving from random CSRF tokens to JWT-based CSRF tokens and adjusts related cookie/refresh-session behavior across the auth flow.

Changes:

• Introduces JWT-signed CSRF tokens with dedicated secret/expiry env vars.
• Renames the CSRF cookie to csrf_token and updates CSRF middleware validation accordingly.
• Adjusts token refresh response/cookie setting and expands CORS methods to include PATCH.

Reviewed changes

Copilot reviewed 9 out of 9 changed files in this pull request and generated 6 comments.

Show a summary per file

File	Description
src/utils/tokens.ts	Adds CSRF JWT env config and updates CSRF token generation.
src/utils/generateAllCookieTokens.ts	Stops returning CSRF token from the “all cookie tokens” helper.
src/types/Auth.ts	Removes csrfToken from RefreshTokenOutput.
src/modules/user/user.controller.ts	Changes get-profile response formatting and imports.
src/modules/auth/utils/createSessionPayload.ts	Generates CSRF JWT alongside access/refresh tokens.
src/modules/auth/auth.service.ts	Removes CSRF token rotation from refresh-tokens service output.
src/modules/auth/auth.controller.ts	Renames CSRF cookie, returns CSRF token in login/register/refresh responses, updates refresh-session handling.
src/middleware/security/requireCsrf.ts	Switches CSRF validation to JWT verification + session/user binding.
src/config/corsConfig.ts	Adds PATCH to allowed CORS methods.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

refreshTokenController only checks that the csrf_token cookie exists, but it does not require/validate an x-csrf-token header (double-submit) and does not verify the CSRF JWT against the refresh token’s session/user. A cross-site POST can still trigger a refresh because the browser will attach both cookies automatically. Require a header token (and compare to the cookie) and verify the CSRF token is bound to the refresh token’s decoded sessionId/userId (or otherwise apply CSRF middleware logic tailored for refresh).

[Copilot]

Cookie name changed from csrf-token to csrf_token. This will break existing logged-in sessions after deploy because clients will still have the old cookie, and csrfMiddleware now only reads csrf_token. Consider a migration period where you accept both cookie names (and/or set/clear both) so existing sessions can continue without forcing users to re-authenticate.

[Copilot]

logoutController now clears only csrf_token. If a user still has the legacy csrf-token cookie, it will remain set after logout. Consider clearing both cookie names during the transition to avoid leaving stale CSRF cookies behind.

Suggested change

	.clearCookie('csrf_token')
	.clearCookie('csrf_token')
	.clearCookie('csrf-token')

[Copilot]

The new CSRF check does a raw headerToken !== cookieToken comparison without normalization/decoding. In practice, cookie values can be quoted or URL-encoded by clients/proxies, which the previous normalizeToken handled; this change can cause valid requests to be rejected. Consider restoring normalization (decode + trim quotes) and using a timing-safe comparison to avoid regressions.

[Copilot]

UnauthorizedError is imported but not used, and getProfileController bypasses sendSuccess, which is used throughout this controller for consistent response shaping/sanitization. Remove the unused import and consider using sendSuccess(res, user, 'Profile retrieved successfully') for consistency.

[Copilot]

CSRF_TOKEN_EXPIRES_IN / CSRF_TOKEN_SECRET are read with non-null assertions. If these env vars are missing or misconfigured, CSRF token generation/verification will fail at runtime with a hard crash or auth errors. Consider validating required env vars at startup (or providing a safe default) so misconfiguration is detected early and reported clearly.