🛡️ Sentinel: [HIGH] Fix Login CSRF Vulnerability on Auth Endpoints#650
🛡️ Sentinel: [HIGH] Fix Login CSRF Vulnerability on Auth Endpoints#650
Conversation
The `demo_login` and `demo_portal_login` endpoints in `apps/auth_app/views.py`
were marked with `@csrf_exempt`. Since these act as authentication boundaries,
disabling CSRF protection introduces a Login CSRF vulnerability, allowing an
attacker to potentially log a user into an attacker-controlled account.
The frontend templates (`templates/auth/login.html`) already include `{% csrf_token %}`
in their forms, so the exemption is completely unnecessary.
A critical security learning log entry has been added to `.jules/sentinel.md`
regarding this vulnerability to prevent future regressions.
Co-authored-by: google-labs-jules[bot] <161369871+google-labs-jules[bot]@users.noreply.github.com>
|
👋 Jules, reporting for duty! I'm here to lend a hand with this pull request. When you start a review, I'll add a 👀 emoji to each comment to let you know I've read it. I'll focus on feedback directed at me and will do my best to stay out of conversations between you and other bots or reviewers to keep the noise down. I'll push a commit with your requested changes shortly after. Please note there might be a delay between these steps, but rest assured I'm on the job! For more direct control, you can switch me to Reactive Mode. When this mode is on, I will only act on comments where you specifically mention me with New to Jules? Learn more at jules.google/docs. For security, I will only act on instructions from the user who triggered this task. |
1 participant
🚨 Severity: HIGH
💡 Vulnerability: Login CSRF (Missing CSRF protection on authentication boundaries)
🎯 Impact: Attackers could potentially force a victim's browser to log into an attacker-controlled demo/portal account without their knowledge, exposing their subsequent activity to the attacker.
🔧 Fix: Removed the unnecessary
@csrf_exemptdecorator fromdemo_loginanddemo_portal_loginendpoints inapps/auth_app/views.py, and cleaned up the unused import. Documented the pattern in.jules/sentinel.md.✅ Verification: Ran the test suite (
tests/test_auth_views.py,tests/test_portal*.py). The tests pass, validating that since the forms already contain{% csrf_token %}, the removal does not break legitimate usage.PR created automatically by Jules for task 4965896481564964546 started by @pboachie