061977126a
CRITICAL FIX: Newsletter subscription was returning "Forbidden" error because the CSRF protection was incorrectly configured. Root cause: - CSRF cookie was set with httpOnly: true - JavaScript cannot read httpOnly cookies - Frontend couldn't extract token to send in X-CSRF-Token header - Double-submit CSRF pattern requires client to read the cookie Changes: - csrf-protection.middleware.js: Set httpOnly: false (required for double-submit pattern) - blog.js: Extract CSRF token from cookie and include in X-CSRF-Token header Security Note: This is the correct implementation per OWASP guidelines for double-submit cookie CSRF protection. The cookie is still protected by SameSite: strict and domain restrictions. Fixes: #newsletter-subscription-forbidden-mobile
82 lines
No EOL
2.1 KiB
JSON
82 lines
No EOL
2.1 KiB
JSON
{
|
|
"version": "1.0.0",
|
|
"session_id": "2025-10-07-001",
|
|
"started": "2025-10-07T19:04:07.677Z",
|
|
"message_count": 1,
|
|
"token_estimate": 0,
|
|
"last_framework_activity": {
|
|
"ContextPressureMonitor": {
|
|
"message": 1,
|
|
"tokens": 0,
|
|
"timestamp": "2025-10-07T19:04:07.677Z",
|
|
"last_level": "NORMAL",
|
|
"last_score": 0
|
|
},
|
|
"InstructionPersistenceClassifier": {
|
|
"message": 0,
|
|
"tokens": 0,
|
|
"timestamp": null,
|
|
"last_classification": null
|
|
},
|
|
"CrossReferenceValidator": {
|
|
"message": 0,
|
|
"tokens": 0,
|
|
"timestamp": null,
|
|
"last_validation": null
|
|
},
|
|
"BoundaryEnforcer": {
|
|
"message": 0,
|
|
"tokens": 0,
|
|
"timestamp": null,
|
|
"last_check": null
|
|
},
|
|
"MetacognitiveVerifier": {
|
|
"message": 0,
|
|
"tokens": 0,
|
|
"timestamp": null,
|
|
"last_verification": null
|
|
},
|
|
"PluralisticDeliberationOrchestrator": {
|
|
"message": 0,
|
|
"tokens": 0,
|
|
"timestamp": null,
|
|
"last_deliberation": null
|
|
},
|
|
"FileEditHook": {
|
|
"timestamp": "2025-10-24T03:42:14.478Z",
|
|
"file": "/home/theflow/projects/tractatus/src/middleware/csrf-protection.middleware.js",
|
|
"result": "passed"
|
|
},
|
|
"FileWriteHook": {
|
|
"timestamp": "2025-10-24T00:04:27.173Z",
|
|
"file": "/home/theflow/projects/tractatus/public/js/admin/editorial-guidelines.js",
|
|
"result": "passed"
|
|
}
|
|
},
|
|
"staleness_thresholds": {
|
|
"messages": 20,
|
|
"tokens": 30000
|
|
},
|
|
"alerts": [],
|
|
"last_updated": "2025-10-24T03:42:14.478Z",
|
|
"initialized": true,
|
|
"framework_components": {
|
|
"CrossReferenceValidator": {
|
|
"message": 0,
|
|
"tokens": 0,
|
|
"timestamp": "2025-10-24T03:42:14.476Z",
|
|
"last_validation": "2025-10-24T03:42:14.476Z",
|
|
"validations_performed": 957
|
|
},
|
|
"BashCommandValidator": {
|
|
"message": 0,
|
|
"tokens": 0,
|
|
"timestamp": null,
|
|
"last_validation": "2025-10-24T03:42:26.291Z",
|
|
"validations_performed": 589,
|
|
"blocks_issued": 66
|
|
}
|
|
},
|
|
"action_count": 589,
|
|
"auto_compact_events": []
|
|
} |