Missing CSRF protection on stateful cookie-based authentication endpoints

[anshul23102]

Summary

The refresh token is stored in an httpOnly cookie. However, the /auth/refresh and /auth/logout endpoints do not verify a CSRF token. A malicious page on another origin can trigger a cross-site POST that causes the browser to send the httpOnly cookie automatically, allowing:

• Forced logout (CSRF on /logout)
• Unauthorized token refresh if the response leaks the new access token in a CORS-permitted response

Impact

• Denial-of-service via forced logout.
• Potential token leakage if CORS Access-Control-Allow-Origin is overly permissive.

Suggested Fix

Add SameSite=Strict (or Lax) to the refresh token cookie, and additionally validate a X-CSRF-Token header on state-changing endpoints:

res.cookie('refreshToken', token, {
  httpOnly: true,
  secure: true,
  sameSite: 'Strict',
});

[anshul23102]

@geturbackend Could you please assign this issue to me? I'd like to work on it under GSSoC '26.
/assign
/claim

[yash-pouranik]

valid?? @coderabbitai

[coderabbitai]

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
set -euo pipefail

repo="geturbackend/urBackend"
issue="379"

printf '%s\n' '=== Issue metadata ==='
gh issue view "$issue" --repo "$repo" --json number,title,state,author,assignees,labels,body,createdAt,updatedAt,url

printf '%s\n' '=== Issue comments ==='
gh api "repos/$repo/issues/$issue/comments?per_page=100" \
  --jq '.[] | {user: .user.login, created_at, body}'

printf '%s\n' '=== Candidate repository guidance files ==='
gh api "repos/$repo/git/trees/main?recursive=1" --paginate \
  --jq -r '.tree[]?.path' \
  | rg -i '(^|/)(contributing|code_of_conduct|readme|guidelines|gssoc)(\.[^/]+)?$' \
  || true

Length of output: 2388

---

🏁 Script executed:

#!/bin/bash
set -euo pipefail

printf '%s\n' '=== Repository top-level files ==='
fd -HI -d 2 -t f -E .git | sed -n '1,240p'

printf '%s\n' '=== Authentication, cookie, CSRF, and CORS references ==='
rg -n -i -C 4 \
  '(auth/refresh|auth/logout|refreshToken|refresh.token|csrf|cors|samesite|sameSite|httponly|httpOnly|origin)' \
  -g '!**/node_modules/**' \
  -g '!**/dist/**' \
  -g '!**/build/**' \
  . \
  | sed -n '1,800p'

printf '%s\n' '=== Repository guidance files ==='
fd -HI -t f -i '^(readme|contributing|code_of_conduct|guidelines|gssoc)(\..*)?$' . \
  -E .git \
  | sed -n '1,160p'

Length of output: 63238

---

🏁 Script executed:

#!/bin/bash
set -euo pipefail

printf '%s\n' '=== Candidate backend files ==='
fd -HI -t f -E .git -E node_modules -E dist -E build . \
  | rg '/(userAuth|auth|csrf|cors|cookie|server|app|index)\.(js|cjs|mjs|ts)$|/(routes|controllers|middlewares)/' \
  | sed -n '1,300p'

printf '%s\n' '=== Definitions and uses related to refresh cookies and CSRF ==='
rg -n -i -C 8 \
  '(res\.cookie\s*\(|clearCookie\s*\(|refreshToken|refresh-token|/logout|csrf|sameSite|cookie-parser|cors\s*\()' \
  apps packages \
  -g '!**/node_modules/**' -g '!**/dist/**' -g '!**/build/**' \
  | sed -n '1,1200p'

printf '%s\n' '=== Relevant contribution guidance ==='
sed -n '1,150p' CONTRIBUTING.md

Length of output: 107752

---

@yash-pouranik, yes. Issue #379 is valid.

The affected routes are POST /api/userAuth/refresh-token and POST /api/userAuth/logout, not /auth/refresh and /auth/logout.

In production, apps/public-api/src/utils/refreshToken.js sets the refresh-token cookie with SameSite=None. The public API has no CSRF or trusted-origin check for these routes.

Also, apps/public-api/src/app.js reflects the request origin, enables credentials, and permits x-api-key. This can let an untrusted origin send a credentialed refresh request and read the returned access token when it uses a publishable API key.

The fix should add CSRF or strict origin validation for cookie-based refresh and logout requests. It should preserve the header-based refresh-token flow for mobile and non-browser clients.

_{You are interacting with an AI system.}

[yash-pouranik]

@anshul23102
Still available to work??