From 47463a62e056167d2db3435c0ad4df2d050fc7c9 Mon Sep 17 00:00:00 2001 From: bruno Date: Fri, 10 Jul 2026 16:12:06 -0400 Subject: [PATCH] =?UTF-8?q?fix:=20403=20on=20/auth/register=20=E2=80=94=20?= =?UTF-8?q?add=20auth=20and=20user=20API=20routes=20to=20CSRF=20exclusion?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit CSRF middleware now excludes /auth/register, /auth/local-login, /api/user, and /api/workspace paths. Login page doesn't have CSRF token so registration and settings operations were blocked. --- app/middleware/csrf.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/app/middleware/csrf.py b/app/middleware/csrf.py index b1af78a..1ee6fe8 100644 --- a/app/middleware/csrf.py +++ b/app/middleware/csrf.py @@ -16,7 +16,7 @@ class CSRFMiddleware(BaseHTTPMiddleware): """ SAFE_METHODS = {"GET", "HEAD", "OPTIONS"} - EXCLUDED_PATHS = {"/api/webhook", "/api/v1", "/auth/callback", "/board/api/pages", "/board/api/favorites", "/db/", "/workspace"} + EXCLUDED_PATHS = {"/api/webhook", "/api/v1", "/auth/callback", "/auth/register", "/auth/local-login", "/api/user", "/board/api/pages", "/board/api/favorites", "/api/workspace", "/db/", "/workspace"} async def dispatch(self, request: Request, call_next): # Webhook receiver, OAuth callback, and internal API are exempt