Protect against login CSRF without cookies for anonymous users

finn/max

0 Fork 0

Anonymous users must not get cookies or session store entries, so a
CSRF token for /login is not possible. Instead, every unsafe request is
checked statelessly via Sec-Fetch-Site, falling back to Origin. Requests
without both headers are not from a browser and are accepted. The
expected origin comes from the new MAX_ORIGIN setting, which is required
outside of debug mode.

Further CSRF changes:
- Do not delete the CSRF token on a failed check. It added no security,
  but invalidated forms in open tabs and could be triggered cross-site.
- Treat HEAD and OPTIONS as safe methods.

Keep the login page free of sessions:
- Show login messages via ?msg=login_required|logout (fixed keys only)
  and the login error via the template context instead of flash().
- Only send the session deletion cookie if the client sent a cookie.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

This commit is contained in:

finnandClaude Opus 5.5 committed 2026-10-21 11:03:03 +00:00

1 parent 91e95b1947

commit dc85c578a2

10 files changed

+89 -32

No files matched your search

									
										Makefile
									
		+1
		-1
	
												View File
												
				@@ -10,7 +10,7 @@ run-dev:

				run-dev-as-prod:

					mkdir -p log

					FLASK_APP=max.app LOG_DIR=log gunicorn -w 1 -b 0.0.0.0:8757 max.app:app

					FLASK_APP=max.app LOG_DIR=log MAX_ORIGIN=http://localhost:8757 gunicorn -w 1 -b 0.0.0.0:8757 max.app:app

				run-cleanup:

					scripts/dev/cleanup.sh