-
Notifications
You must be signed in to change notification settings - Fork 0
Open
Description
Description
The registration and login forms in the application currently lack CSRF (Cross-Site Request Forgery) protection, making them vulnerable to CSRF attacks where malicious websites could submit forms on behalf of authenticated users.
Affected Files
templates/auth_pages/register.templ
templates/auth_pages/login.templ
- Authentication handlers in
internal/delivery/http/handler/auth_handler.go
Security Risk
Without CSRF protection, attackers can:
- Create malicious websites that automatically submit registration/login forms
- Potentially compromise user accounts through social engineering
- Perform unauthorized actions on behalf of users
Proposed Solution
- Add CSRF middleware to the application (e.g., gin-contrib/csrf)
- Include CSRF tokens in authentication forms
- Validate CSRF tokens on form submission
References
- Pull Request: Feat/frontend #39
- Comment: Feat/frontend #39 (comment)
Priority
High - This is a security vulnerability that should be addressed promptly.
cc @itsLeonB
Metadata
Metadata
Assignees
Labels
No labels