feat: add CSRF protection middleware#3332

Open

deacon-mp wants to merge 26 commits into

Commits on Mar 2, 2026

initial commit with CSRF mitigations
Fiona McCrae
committed

Commits on Mar 9, 2026

added some tests for CSRF middleware
Fiona McCrae
committed

Commits on Mar 16, 2026

added additional CSRF tests
Fiona McCrae
committed
separated regular functioning security tests from CSRF tests
Fiona McCrae
committed
fix: bump cryptography to 46.0.5 and expand CI security coverage

deacon-mp
authored and
Fiona McCrae
committed
fix: reuse existing fact source on operation close (#3261)

ChenFryd
authored and
Fiona McCrae
committed
Bump minimatch from 3.1.2 to 3.1.5 (#3258)

dependabot[bot]
authored and
Fiona McCrae
committed
Add architecture field to agent deployment commands (#3260)

authored and
Fiona McCrae
committed
hash passwords and API keys in main config (#3257)

authored and
Fiona McCrae
committed
fix: replace create_subprocess_shell (#3265)

authored and
Fiona McCrae
committed
fix: replace deprecated asyncio.get_event_loop() with new_event_loop() (#3266)

deacon-mp
authored and
Fiona McCrae
committed
fix: reduce global client_max_size and add configurable setting (#3268)

deacon-mp
authored and
Fiona McCrae
committed
fix: degrade gracefully when magma plugin dist is absent (#3275)

deacon-mp
authored and
Fiona McCrae
committed
fix: guard against None agent in operations summary endpoint (#3181) (#3276)

deacon-mp
authored and
Fiona McCrae
committed
fix: resolve trait-only relationship facts from source fact list on operation init (#3278)

deacon-mp
authored and
Fiona McCrae
committed
fix: prevent operation report from returning null when link paw absent (#3048) (#3279)

deacon-mp
authored and
Fiona McCrae
committed
fix: correct exfil operation filter and patch path traversal bypass (#3280)

deacon-mp
authored and
Fiona McCrae
committed
fix: validate upload filename character set in file_svc (#3267)

deacon-mp
authored and
Fiona McCrae
committed
fix: register SIGTERM handler in run_tasks() to save state on service shutdown (#3018) (#3277)

deacon-mp
authored and
Fiona McCrae
committed
added modification to test_authentication_required_middleware_authenticated_endpoint_accepts_session_cookie to match updated auth_svc code where EncryptedCookieStorage is configured with secure=True
Fiona McCrae
committed
added test to show that without cookie, authenticated endpoint session will fail (opposite of previous commit fix)
Fiona McCrae
committed
CSRF operation tests are passing, including tests to verify resiliency against timing attacks, CSRF token operates as required, skips depending on whether authentication is required, and a test of …
Fiona McCrae
committed
security.py change allowing CSRF protections to be bypassed if the session is authentication exempt. This may need more security refinement
Fiona McCrae
committed
CSRF operation creation test now passes - small change reflecting updates to master branch
Fiona McCrae
committed
linting reformatting
Fiona McCrae
committed
Merge branch 'master' into VIRTS-1953
Fiona McCrae
committed