Repository navigation
fix(web): same-origin check on cookie-authenticated kit and collection writes #113
Description
Follow-up to #101, which covered favorite/vote/rate/review. The personal kit (kit-http.ts) and collection (collection-http.ts) write paths accept session cookies without crossOriginRefusal (apps/web/app/lib/auth/same-origin.ts). They are currently shielded by the mandatory Content-Type: application/json (and preflight for PATCH/DELETE), so this is defence in depth, not an open hole. Apply the check only when the request is authenticated by the session cookie, so API-key clients keep working; add a test per route group: a foreign Origin returns 403, while same-origin and header-less requests pass. Found during review of #112.
Activity
mrgoonie commentedon Oct 29, 2026
Shipped in #159 (squash
25dabcaonmain).The production check had already landed in #103:
resolveLimitedScopedActorrefuses a foreign Origin on the session-cookie path, and every kit and collection write goes through it. #159 adds the requested tests per route group:Sec-Fetch-Site: same-sitegets 403cross_originon every collection write sub-route and every kit write sub-route, and nothing is written.Evidence:
web-contracts-cliis green.Generated by Claude Code
test(web): cover same-origin checks on kit and collection writes (nex…