fix(security): add centralized CSRF protection

[Ridanshi]

Closes Priyanshu-byte-coder#1878

Security analysis

DevTrack uses NextAuth JWT session cookies (SameSite=Lax, HttpOnly, Secure in production) for all browser-authenticated routes. Before this fix, no Origin or Referer validation existed — any cross-origin page could issue authenticated state-changing requests (POST/PUT/PATCH/DELETE) on behalf of a logged-in user by exploiting cookie auto-attachment.

SameSite=Lax provides partial CSRF mitigation (blocks cross-site form POSTs) but does not protect against:

• Cross-site fetch/XHR from malicious pages (allowed on same registered-domain subdomains)
• Older browsers with weaker SameSite defaults
• Future cookie configuration changes

Authentication architecture discovered

Client type	Auth mechanism	CSRF risk
Browser (logged-in user)	NextAuth JWT cookie	Vulnerable — fixed here
GitHub webhook delivery	HMAC x-hub-signature-256	Not vulnerable — exempted
Vercel Cron / sync jobs	Authorization: Bearer CRON_SECRET	Not vulnerable — exempted
Local-coding CLI agent	Authorization: Bearer <api-key>	Not vulnerable — exempted
NextAuth internals (/api/auth/*)	Managed by NextAuth	Not vulnerable — exempted

Root cause

No CSRF protection existed anywhere in the codebase. All browser-session mutation routes accepted requests from any origin as long as a valid session cookie was present.

Protection strategy

Centralized Origin/Referer validation in src/lib/csrf.ts, enforced at the middleware layer (src/middleware.ts) before any route handler runs.

Decision logic in checkCsrfOrigin():

Request type	Decision
GET / HEAD / OPTIONS	Pass (not mutations)
Authorization: Bearer … present	Pass (machine client — cannot be CSRF'd)
Origin matches trusted set	Pass
Origin present, not trusted	403 Forbidden
No Origin, Referer matches trusted set	Pass
No Origin, Referer not trusted	403 Forbidden
No Origin, no Referer	Pass (server-side / native client)

Trusted origins are built from:

• NEXTAUTH_URL (required; canonical app origin)
• NEXT_PUBLIC_APP_URL (optional; alternate public origin)
• ALLOWED_ORIGINS (comma-separated list of additional trusted origins)
• http://localhost:3000 and http://127.0.0.1:3000 in non-production environments

Protected routes

All POST, PUT, PATCH, DELETE requests under /api/ that do not carry a Bearer token are now protected, including:

• POST/PATCH/DELETE /api/goals, /api/goals/[id]
• PATCH /api/user/settings
• DELETE /api/user/data-export
• POST /api/daily-note, /api/contact
• POST/DELETE /api/local-coding/keys
• POST/PATCH/DELETE /api/webhooks/custom, /api/webhooks/custom/[id]
• PATCH/DELETE /api/notifications, /api/notifications/[id]
• POST/DELETE /api/streak/freeze
• POST /api/rooms, /api/integrations/jira/credentials

Exempted routes

Route	Reason
/api/webhooks/github	HMAC x-hub-signature-256 authentication
/api/cron/*	Bearer CRON_SECRET
/api/wakatime/sync	Bearer CRON_SECRET
/api/sponsors/sync	Bearer CRON_SECRET
/api/notifications/discord-sync	Bearer CRON_SECRET
/api/local-coding/sync	Bearer API-key
/api/auth/*	NextAuth-managed endpoints

Any request with Authorization: Bearer … is also globally exempt.

Configuration changes

Added to .env.example:

ALLOWED_ORIGINS=http://localhost:3000,https://devtrack.app

Tests added (test/csrf.test.ts — 61 tests)

• isMutationMethod: POST/PUT/PATCH/DELETE → true; GET/HEAD/OPTIONS → false
• isCsrfExemptPath: all exempt prefixes pass; protected routes fail correctly
• checkCsrfOrigin: trusted origin, untrusted origin, missing headers, Bearer exemption, Referer fallback, ALLOWED_ORIGINS, NEXT_PUBLIC_APP_URL, each mutation method, precedence rules, webhook/cron/integration bypass scenarios

Verification

pnpm lint      — warnings only (pre-existing, unrelated)
pnpm typecheck — clean
pnpm test      — 61 CSRF tests pass

[github-actions]

GSSoC Label Checklist 🏷️

@Ridanshi — please apply the appropriate labels before merging:

Difficulty (pick one):

• level:beginner — 20 pts
• level:intermediate — 35 pts
• level:advanced — 55 pts
• level:critical — 80 pts

Quality (optional):

• quality:clean — ×1.2 multiplier
• quality:exceptional — ×1.5 multiplier

Validation (required to score):

• gssoc:approved — counts for points
• gssoc:invalid / gssoc:spam / gssoc:ai-slop — does not score

Type labels (type:*) are auto-detected from files and title. Review and adjust if needed.
Points formula: (difficulty × quality_multiplier) + type_bonus

[Ridanshi]

Closing this PR — CSRF protection for state-changing API routes was already contributed to upstream by another contributor (PR Priyanshu-byte-coder#1983, merged as commit b469777 on 2026-06-04), and issue Priyanshu-byte-coder#1878 is closed. The code on this branch is superseded by that upstream merge.