fuomag9 bdd3019214 security: add same-origin CSRF check to state-changing user API routes ...

Adds checkSameOrigin() helper in auth.ts that validates the Origin header
against the Host header. If Origin is present and mismatched, returns 403.
Applied to all 5 custom POST routes flagged in CPM-003 (NEXT-CSRF-001):
  - change-password, link-oauth-start, unlink-oauth, update-avatar, logout

SameSite=Lax (NextAuth default) already blocks standard cross-site CSRF;
this adds defense-in-depth against subdomain and misconfiguration scenarios.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

2026-03-05 01:04:18 +01:00

..

route.ts

security: add same-origin CSRF check to state-changing user API routes

2026-03-05 01:04:18 +01:00