admin/e-ticket
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Add automatic CSRF protection on all POST forms

Browse Source 
- CsrfProtectionSubscriber: auto-injects hidden _csrf_token in HTML responses,
  auto-verifies on POST requests
- Excludes: webhooks, JSON APIs, login (has its own CSRF)
- 9 tests covering all cases (GET, excluded, JSON, no token, invalid, valid, inject, non-HTML)

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
This commit is contained in:
Serreau Jovann
2026-03-22 20:08:02 +01:00
parent 36456e8dfe
commit 25033c29a0
3 changed files with 259 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
TASK_CHECKUP.md
View File

@@ -45,7 +45,7 @@
### Sécurité & Performance
- [x] Rate limiting sur les routes sensibles (login 5/15min, commande 10/5min, invitation 5/15min, contact 3/10min)
- [ ] CSRF token sur tous les formulaires POST
- [x] CSRF token sur tous les formulaires POST (auto-inject + auto-verify)
- [ ] Cache Meilisearch : invalider quand un événement est modifié
- [ ] Optimiser les requêtes N+1 (stats tab, billets par catégorie)