feat(csrf): add Origin/Referer CSRF protection (#1878)

[ask-z4ch]

Closes #1878

Changes made: added Origin/Referer CSRF validation in src/lib/csrf.ts + middleware integration in src/middleware.ts

Testing done: npm run type-check (zero errors), npm run lint (zero new warnings), npx playwright test e2e/csrf.spec.js (5/5 passed), npx playwright test --workers=1 (19 pass, 4 pre-existing failures - zero regressions)

════════════════════════════════════════

Purpose & Rationale

The app had no CSRF protection on API state-changing methods. A compromised site could forge POST/PUT/PATCH/DELETE requests from a logged-in user's browser, enabling unauthorized goal creation, settings changes, or data mutation. This adds Origin/Referer header validation at the middleware layer to block cross-origin forgeries while exempting webhook endpoints that receive requests from external services.

Technical Resolution Details

Added src/lib/csrf.ts with validateCsrf(), isStateChangingMethod(), and isCsrfExempt(). The utility reads ALLOWED_ORIGINS from env (auto-including NEXTAUTH_URL, NEXT_PUBLIC_APP_URL, and http://localhost:3000 in dev), then validates incoming Origin or Referer headers against the allowed set. Exempted routes are webhook prefixes (/api/webhooks/*) and rate-limited auth/metrics paths.

Updated src/middleware.ts with a CSRF check block before the rate-limit section, and expanded config.matcher from three specific prefix patterns to a single catch-all /api/:path*, ensuring CSRF coverage across all API routes.

Added 5 E2E tests in e2e/csrf.spec.js, plus the ALLOWED_ORIGINS env var to .env.example.

Local Testing Execution

1. npm run type-check - zero errors
2. npm run lint - zero new warnings
3. npx playwright test e2e/csrf.spec.js --workers=1 - 5/5 passed
4. npx playwright test --workers=1 - 23 total, 19 pass + 4 pre-existing failures on upstream/main (auth pattern from unmerged [BUG] fix: E2E dashboard-widgets smoke tests consistently fail in CI due to missing auth session #1972), zero regressions from this change

Desired Review Feedback Type

Edge-case review of the origin-matching logic in validateCsrf() - specifically the startsWith suffix handling and whether the webhook exemption list covers all external-receiver endpoints.

Integrity & AI Usage Disclosure

In compliance with the GSSoC 2026 AI Conduct rules, I disclose that AI tools were used solely as learning and boilerplate aids. The final logic was fully reviewed, tested, and manually adapted to match human styling and clean-code design.

[vercel]

@ask-z4ch is attempting to deploy a commit to the PRIYANSHU DOSHI's projects Team on Vercel.

A member of the Team first needs to authorize it.

[github-actions]

GSSoC Label Checklist 🏷️

@Priyanshu-byte-coder — please apply the appropriate labels before merging:

Difficulty (pick one):

• level:beginner — 20 pts
• level:intermediate — 35 pts
• level:advanced — 55 pts
• level:critical — 80 pts

Quality (optional):

• quality:clean — ×1.2 multiplier
• quality:exceptional — ×1.5 multiplier

Validation (required to score):

• gssoc:approved — counts for points
• gssoc:invalid / gssoc:spam / gssoc:ai-slop — does not score

Type labels (type:*) are auto-detected from files and title. Review and adjust if needed.
Points formula: (difficulty × quality_multiplier) + type_bonus

[ask-z4ch]

@Priyanshu-byte-coder

The 4 dashboard-widgets.spec.js and notifications.spec.js failures visible in the full suite run are pre-existing on upstream/main.

They require the auth token encoding fixes from #1976 (fixes #1972 ). This PR contains zero changes to those spec files; the 5 CSRF-specific E2E tests all pass cleanly. Once #1976 is merged, the full suite will be green.

[Priyanshu-byte-coder]

This PR has merge conflicts with main — the src/middleware.ts was recently refactored in #1940 (auth rate limiting). Please rebase:

git fetch origin
git rebase origin/main
# Resolve conflicts in src/middleware.ts carefully — integrate the CSRF checks alongside the new auth rate limiting logic
git push --force-with-lease

[ask-z4ch]

@Priyanshu-byte-coder

Confirmed the 2 theme.spec.js failures are pre-existing on upstream/main - tracked in #2001.

They're caused by a UI refactor that replaced the theme toggle button with a combobox, unrelated to this PR.

All 5 CSRF-specific tests (e2e/csrf.spec.js) pass cleanly, and no other tests regressed.

[github-actions]

🎉 Merged! Thanks for contributing to DevTrack.

If the project has been useful to you, a ⭐ star on the repo is the easiest way to support it — it helps DevTrack get discovered by more developers.

Keep an eye on open issues for your next contribution!