Skip to content

Security: Add CSRF protection to authentication forms #40

@coderabbitai

Description

@coderabbitai

Description

The registration and login forms in the application currently lack CSRF (Cross-Site Request Forgery) protection, making them vulnerable to CSRF attacks where malicious websites could submit forms on behalf of authenticated users.

Affected Files

  • templates/auth_pages/register.templ
  • templates/auth_pages/login.templ
  • Authentication handlers in internal/delivery/http/handler/auth_handler.go

Security Risk

Without CSRF protection, attackers can:

  1. Create malicious websites that automatically submit registration/login forms
  2. Potentially compromise user accounts through social engineering
  3. Perform unauthorized actions on behalf of users

Proposed Solution

  1. Add CSRF middleware to the application (e.g., gin-contrib/csrf)
  2. Include CSRF tokens in authentication forms
  3. Validate CSRF tokens on form submission

References

Priority

High - This is a security vulnerability that should be addressed promptly.

cc @itsLeonB

Metadata

Metadata

Assignees

Labels

No labels
No labels

Projects

No projects

Milestone

No milestone

Relationships

None yet

Development

No branches or pull requests

Issue actions