Skip to content

fix(security): validate port in CSRF origin check (#7212) - #7355

Merged
JhaSourav07 merged 1 commit into
JhaSourav07:mainfrom
atul-upadhyay-7:fix/issue-7212-csrf-port-validation
Jul 4, 2026
Merged

fix(security): validate port in CSRF origin check (#7212)#7355
JhaSourav07 merged 1 commit into
JhaSourav07:mainfrom
atul-upadhyay-7:fix/issue-7212-csrf-port-validation

Conversation

@atul-upadhyay-7

@atul-upadhyay-7 atul-upadhyay-7 commented Jul 3, 2026

Copy link
Copy Markdown
Contributor

Fixes #7212

Problem

The isValidOrigin function in lib/security/csrf.ts only checked protocol and hostname when validating the Origin header, ignoring the port entirely. This allowed CSRF bypass from any server sharing the same hostname on a different port (e.g. Origin: https://commitpulse.vercel.app:9999).

Solution

  1. Added normalizePort() helper that resolves empty URL.port to the protocol default (443 for https, 80 for http), since URL.port returns empty string for default ports
  2. Updated isValidOrigin to compare normalized ports alongside protocol and hostname
  3. Added 15 unit tests in lib/security/csrf.test.ts covering:
    • Port mismatch rejection (the core vulnerability)
    • Default port normalization (:443 matches no-port for HTTPS)
    • Custom port via NEXT_PUBLIC_SITE_URL env var
    • Referer header fallback with port validation
    • Malformed origin rejection
    • Combined origin + referer scenarios

Changes

  • lib/security/csrf.ts: Added normalizePort(), updated isValidOrigin() port comparison
  • lib/security/csrf.test.ts: New test file with 15 test cases

@atul-upadhyay-7
fix(security): validate port in CSRF origin check (#7212)
880b97c 
- Add normalizePort() helper that resolves empty URL.port to the
  protocol default (443 for https, 80 for http)
- Compare normalized ports in isValidOrigin so requests from
  mismatched ports (e.g. :9999) are rejected even when hostname
  and protocol match
- Add 15 unit tests covering: port mismatch, default port
  normalization, env-based custom ports, referer fallback, malformed
  origin, and combined origin+referer scenarios
Copilot AI review requested due to automatic review settings July 3, 2026 16:38
Copilot AI reviewed Jul 3, 2026

Copilot AI left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.

@atul-upadhyay-7 atul-upadhyay-7 mentioned this pull request Jul 3, 2026
Closed
@github-actions

github-actions Bot commented Jul 3, 2026

Copy link
Copy Markdown
Contributor

📦 Next.js Bundle Size Report (Gzipped Sizes)

✨ No significant bundle size changes detected.

📊 Summary of Totals

Category PR Size Base Size Difference
Total JS 3883.44 KB 3883.44 KB 0 B
Total CSS 323.09 KB 323.09 KB 0 B

@github-actions github-actions Bot added the type:bug Something isn't working as expected label Jul 4, 2026
@Aamod007 Aamod007 added mentor:Aamod007 level:advanced Complex contributions involving architecture, optimization, or significant feature work type:security Security fixes, dependency updates, or hardening quality:clean PR follows clean coding practices, proper formatting, documentation, and maintainability standards. labels Jul 4, 2026
Aamod007
Aamod007 approved these changes Jul 4, 2026
View reviewed changes

@Aamod007 Aamod007 left a comment

Copy link
Copy Markdown
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Hey! Thanks for addressing the CSRF origin validation vulnerability. Restricting origin checks down to the precise port blocks a major attack vector in local or shared-hosting environments.

I'm assigning level:advanced, type:security, and quality:clean.

Fantastic catch, approving!

@JhaSourav07 JhaSourav07 added the gssoc:approved PR has been reviewed and accepted for valid contribution points label Jul 4, 2026
@JhaSourav07
JhaSourav07 merged commit 139eb33 into JhaSourav07:main Jul 4, 2026
9 checks passed
@github-actions github-actions Bot added this to the GSSoC 2026 milestone Jul 4, 2026
@github-actions

github-actions Bot commented Jul 4, 2026

Copy link
Copy Markdown
Contributor

🎉 Congratulations @atul-upadhyay-7! Your PR has been successfully merged. 🚀

Thank you for contributing to CommitPulse. Your work helps us build a better tool for the community.

⚠️ Important for GSSoC Contributors:
You are strictly advised to join our Discord Server as it is mandatory for all GSSoC participants. All important announcements, point claims, and community discussions happen there.

Keep building! 💻✨

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

Copilot code review Copilot
Copilot review effort
Applies to this pull request for everyone.Learn more about Copilot code review.
Copilot left review comments
@Aamod007 Aamod007 Aamod007 approved these changes

Assignees

No one assigned

Labels

gssoc:approved PR has been reviewed and accepted for valid contribution points level:advanced Complex contributions involving architecture, optimization, or significant feature work mentor:Aamod007 quality:clean PR follows clean coding practices, proper formatting, documentation, and maintainability standards. type:bug Something isn't working as expected type:security Security fixes, dependency updates, or hardening

Projects

None yet

Milestone

GSSoC 2026

Development

Successfully merging this pull request may close these issues.

fix(auth): origin port not validated in CSRF check — bypassable

4 participants

@atul-upadhyay-7 @Aamod007 @JhaSourav07