fix: app.js reads CSRF cookies in the reverse of the backend's precedence
Maintainers usually reply within 1 day
Nobody has claimed this yet.
Assessment
- Difficulty
- 2/5
- Estimated time
- 1-3 hours
- Newbie friendliness
- 82/100
- Issue type
- Bug
- Clarity
- Clearly specified
- Activity status
- Active
- Tech stack
- javascript, python
Research direction
Read dashboard/frontend/app.js near line 3910 and compare its cookie order with dashboard/backend/csrf.py near line 79. Then inspect the existing CSRF tests and add a regression case with both cookies set to different values. Done means the frontend and backend select the same token and the regression test passes.
Written by the indexing model from the issue text.
Description
dashboard/frontend/app.js:3910 iterates the CSRF cookie names dev-first:
for (const name of ['atl_csrf', '__Host-atl_csrf']) {
dashboard/backend/csrf.py:79 reads them host-first, unconditionally:
for name in (_HOST_CSRF, _DEV_CSRF):
Double-submit only compares equal when both sides pick the same cookie, so wherever the jar holds both with different values the frontend submits one token and the backend validates against the other — every write 403s until the user clears cookies.
When both coexist. The backend sets only one (csrf_cookie_name(), :52, on cookie_secure()), so this is not a steady state — it is a transition. A browser holding atl_csrf from before ATL_COOKIE_SECURE/RENDER became truthy keeps it (the __Host- prefix forbids Domain, so the new cookie cannot overwrite the old name), and the server then issues __Host-atl_csrf beside it. :74 clears both, so a logout/login cycle resolves it — which is also why this can look intermittent and user-specific.
Fix: swap the array to ['__Host-atl_csrf', 'atl_csrf'] to match csrf.py:79.
Introduced by #285. The same defect was copied into dashboard/frontend/js/admin-shell.js and fixed there in #488, which deliberately leaves this call site alone — the two are independent copies, and this one is not that PR's to change.
A regression test needs to set both cookies to different values; the existing CSRF tests set one at a time and are structurally blind to ordering.
🤖 Filed with Claude Code
- Dominant language
- Python
- Stars
- 767
- Forks
- 156
- Avg merge
- 22h 57m
- Merged PRs (30d)
- 84
Getting set up
- Ships a Dockerfile or Docker Compose file
- No pull request template
- No contributing guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
More from Open-Finance-Lab/AgenticTrading
-
Difficulty 2/5 1-3 hours Newbie friendliness 80/100
Open-Finance-Lab/AgenticTrading#663 ·
Maintainers usually reply within 1 day
-
Difficulty 2/5 1-3 hours Newbie friendliness 84/100
Open-Finance-Lab/AgenticTrading#661 ·
Maintainers usually reply within 1 day
-
fix(llm): a non-ASCII execution handoff raises UnicodeEncodeError instead of ExecutionHandoffErrorPossibly taken @subidhkhanal claimed this 3 days ago. Open
Difficulty 2/5 1-3 hours Newbie friendliness 85/100
Open-Finance-Lab/AgenticTrading#659 ·
Maintainers usually reply within 1 day
-
fix(backtests): an LLM action with trailing whitespace ("buy ") is silently droppedPossibly taken @subidhkhanal claimed this 3 days ago. Open
Difficulty 2/5 1-3 hours Newbie friendliness 83/100
Open-Finance-Lab/AgenticTrading#658 ·
Maintainers usually reply within 1 day
-
fix(llm): Gemini adapter drops thinking tokens from the output countPossibly taken @subidhkhanal claimed this 3 days ago. Open
Difficulty 2/5 1-3 hours Newbie friendliness 88/100
Open-Finance-Lab/AgenticTrading#657 ·
Maintainers usually reply within 1 day
All issues in Open-Finance-Lab/AgenticTrading
Similar issues
-
Difficulty 1/5 Under an hour Newbie friendliness 85/100
521xueweihan/HelloGitHub#4115 ·
-
get_lldp_neighbors_detail: query asks for 'max-address' (typo for 'mac-address'), so remote_chassis_id is always emptyPossibly taken @Jah-yee claimed this today. Open
Difficulty 1/5 Under an hour Newbie friendliness 88/100
-
lesson-submission pending-review
Difficulty 1/5 Under an hour Newbie friendliness 74/100
Ikalus1988/MisakaNet#3899 ·
Maintainers usually reply within 1 day
-
Difficulty 2/5 1-3 hours Newbie friendliness 68/100
aws-samples/sample-per-model-bedrock#549 ·
Maintainers usually reply within 1 day
-
Difficulty 1/5 Under an hour Newbie friendliness 90/100