Security: CSRF Token Injection Vulnerability in Double Submit Cookie Protection #1657

Bug Description

The Double Submit Cookie CSRF protection implemented in backend/csrf.py is vulnerable to Token Injection. The middleware verifies that the csrftoken cookie matches the X-CSRF-Token header using secrets.compare_digest(cookie_token, header_token). However, it does not validate the minimum length or format of the tokens. An attacker can set a short, known token (e.g., "a") in the user's csrftoken cookie (e.g., via a sub-domain XSS or MITM if secure flag is bypassed) and then send a cross-site request with the matching "a" in the header. The server will accept this as valid CSRF validation since "a" == "a".

Steps to Reproduce

1. Intercept a legitimate request to a protected endpoint (e.g., POST).
2. Modify the csrftoken cookie value to "a".
3. Modify the X-CSRF-Token request header value to "a".
4. Send the request.
5. Observe that the server accepts the request with a 200/201 status code instead of throwing a 403 Forbidden.

Expected Behavior

The CSRF middleware should enforce a strict length check on the tokens (e.g., exactly 64 hexadecimal characters) or use HMAC signatures to ensure the token was generated by the server.

Actual Behavior

The middleware accepts any matching token pair, regardless of length, allowing trivial CSRF token injection if an attacker can write a cookie to the victim's browser.

Screenshots / Error Logs

N/A

Environment

• OS: Any
• Python version: Any
• Browser: Any

Additional Context

Advanced level security vulnerability. Occurs in backend/csrf.py inside the CSRFMiddleware class.