[loop-cycle-2] fix: resolve endpoint before execution in CSRF middleware (#626) #656

Timmy · 2026-03-20T23:04:54Z

Timmy commented

2026-03-20 23:04:54 +00:00

Summary

Fixes #626 — CSRF middleware was executing endpoints before checking @csrf_exempt.

Problem

When CSRF validation failed and the path was not in the exempt list, the middleware called call_next(request) which executed the endpoint (including all side effects like DB writes), then checked @csrf_exempt afterward. Non-exempt endpoints ran regardless of CSRF protection.

Fix

Added _resolve_endpoint() method that walks the FastAPI/Starlette middleware chain to find the matching route endpoint WITHOUT executing it
Check @csrf_exempt on the resolved endpoint BEFORE calling call_next()
If not exempt, return 403 immediately without ever executing the endpoint

Tests

Added regression test proving protected endpoints do NOT execute when CSRF fails
Added test confirming @csrf_exempt endpoints still execute normally
All 21 CSRF tests pass

Net lines

~+25 code, -5 removed = modest net add, but eliminates a security vulnerability

## Summary Fixes #626 — CSRF middleware was executing endpoints before checking `@csrf_exempt`. ## Problem When CSRF validation failed and the path was not in the exempt list, the middleware called `call_next(request)` which **executed the endpoint** (including all side effects like DB writes), then checked `@csrf_exempt` afterward. Non-exempt endpoints ran regardless of CSRF protection. ## Fix - Added `_resolve_endpoint()` method that walks the FastAPI/Starlette middleware chain to find the matching route endpoint WITHOUT executing it - Check `@csrf_exempt` on the resolved endpoint BEFORE calling `call_next()` - If not exempt, return 403 immediately without ever executing the endpoint ## Tests - Added regression test proving protected endpoints do NOT execute when CSRF fails - Added test confirming `@csrf_exempt` endpoints still execute normally - All 21 CSRF tests pass ## Net lines ~+25 code, -5 removed = modest net add, but eliminates a security vulnerability

Timmy added 1 commit 2026-03-20 23:04:54 +00:00

fix: resolve endpoint before execution in CSRF middleware (#626 )

Tests / lint (pull_request) Has been cancelled

Details

Tests / test (pull_request) Has been cancelled

Details

2a4f6228c7

Previously, when CSRF validation failed and the path wasn't in the exempt
list, the middleware called call_next() to execute the endpoint BEFORE
checking the @csrf_exempt decorator. This caused side effects (DB writes,
API calls, etc.) to occur on protected endpoints even when CSRF validation
failed.

Now the middleware resolves the route endpoint by walking the FastAPI/
Starlette router WITHOUT executing it, checks @csrf_exempt, and only
then either allows the request through or returns 403.

- Add _resolve_endpoint() method to walk middleware chain and match routes
- Remove call_next() before @csrf_exempt check (5 lines deleted)
- Add regression test proving endpoints don't execute before CSRF check
- Add test confirming @csrf_exempt endpoints still execute normally

Timmy merged commit 9d0f5c778e into main

2026-03-20 23:05:10 +00:00

Timmy deleted branch fix/csrf-exempt-check-before-dispatch

2026-03-20 23:05:10 +00:00

Timmy referenced this issue from a commit

2026-03-20 23:05:11 +00:00

[loop-cycle-2] fix: resolve endpoint before execution in CSRF middleware (#626) (#656)

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: Rockachopa/Timmy-time-dashboard#656