Critical Security: Prevent Cross-Site Request Forgery (CSRF) on state-changing API endpoints

[basantnema31]

Description

Currently, the application does not implement anti-CSRF tokens for POST/PUT/DELETE requests. This means a malicious site can trick an authenticated user's browser into making state-changing requests to the API, leading to unauthorized actions.

Proposed Solution

I propose implementing the Double Submit Cookie pattern or synchronizer token pattern for all state-changing API routes. This involves sending a unique CSRF token in a secure cookie and verifying it against a custom request header on the server.

I would love to work on this critical security issue under the GSSoC '24 program! Could you please assign it to me?

[github-actions]

👋 Thanks for opening this issue! We appreciate your contribution. Please make sure you’ve provided all the necessary details and screenshots, and don't forget to follow our Guidelines and Code of Conduct. Happy coding! 🚀

[github-actions]

👋 Thank you for raising an issue! We appreciate your effort in helping us improve. Our FinVeda team will review it shortly. Stay tuned!

[ayush-that]

hey @basantnema31, thanks for opening this. before assigning, a few asks since the issue is generic and this repo is mostly static frontend (HTML/CSS/JS + a small python piece):

1. which specific endpoint or route is vulnerable? please link the file and line.
2. did you reproduce the CSRF by writing a proof-of-concept that triggers an unauthorized state change? a short repro (curl command or screenshot) would help.
3. the proposed mitigation lists two well-known patterns. which one fits this stack, and why?

happy to assign once those are answered. if you'd rather open a draft PR demonstrating the issue and the fix directly, that works too.

[github-actions]

✅ This issue has been successfully closed. Thank you for your contribution and helping us improve the project! If you have any more ideas or run into other issues, feel free to open a new one. Happy coding! 🚀