Repository navigation
Persist the CSRF secret when updating a session - #6832
Open
lisboarocha wants to merge 1 commit into
Open
lisboarocha wants to merge 1 commit into
lisboarocha wants to merge 1 commit into
Conversation
KnexSessionStore.set() writes a session with insert ... onConflict(id).merge([...]), and csrfToken was missing from the merge list. The secret was therefore written only when the session row was first inserted: a CSRF token generated for a session that already existed was never persisted, and the next state-changing request to the private API failed with 403 "Missing csrf secret". With saveUninitialized disabled, a session row can exist before any token has been requested. GET /api/private/auth/oidc/:id is one such path: it saves the session with pendingUser. A client that then asks for a token and confirms the pending user gets the 403. Add csrfToken to the merge list, and a unit test asserting that the upsert updates csrf_token on conflict. The test fails without the change. Signed-off-by: Waldir Lisboa Rocha <lisboarocha@prefi.tech>
ErikMichelson
self-requested a review
September 25, 2026 13:07
This branch has not been deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Fixes #6831.
KnexSessionStore.set()upserts the session withonConflict(id).merge([...]), andcsrfTokenwas missing from the merge list, so a CSRF secret generated for a session that already existed was never persisted. This adds it, with a unit test.Change
backend/src/sessions/knex-session-store.ts: addFieldNameSession.csrfTokento the merge list. Every other persisted field was already there, exceptid, which is the conflict key, andcreatedAt, which is excluded on purpose.backend/src/sessions/knex-session-store.spec.ts: a test asserting that the generated upsert updatescsrf_tokenon conflict.Verification
All on
developatf199a28.The test fails without the change, and the generated SQL shows why:
With the change, the suite passes: 6 of 6.
Built backend, before and after, same reproduction as in the issue (sqlite, one OIDC provider configured):
Suites: backend unit tests 45 suites, 578 tests passed (577 before the change, plus the new one); backend e2e on sqlite 15 suites, 405 tests passed, the same as before the change;
oxlint0 warnings and 0 errors;oxfmt --checkclean.