Security

CSRF vs Bearer

• Endpoints that require CSRF (cookie-based or session-based state-changing requests):
  When the client sends cookies (e.g. browser), state-changing methods (POST, PUT, PATCH, DELETE) must include the X-CSRF-Token header matching the csrf_token cookie. The server sets the CSRF cookie on login and register.

  • POST /api/v1/auth/register
  • POST /api/v1/auth/login
  • POST /api/v1/auth/logout
  • POST /api/v1/auth/refresh
  • POST /api/v1/auth/password-reset
  • POST /api/v1/auth/password-reset/confirm
  • POST /api/v1/auth/verify-email
  • POST /api/v1/auth/mfa-verify
  • POST /api/v1/auth/magic-link/request
  • POST /api/v1/auth/magic-link/consume
  • POST /api/v1/auth/mfa/sms/send

• Endpoints that use only Authorization (Bearer token or API key):
  No CSRF token is required. Use Authorization: Bearer <access_token> or the API key header.

  • All routes under /api/v1 that use AuthRequired (organizations, users, MFA, OAuth client CRUD, API keys, webhooks, members, SAML metadata/SP CRUD, LDAP config CRUD, SCIM Users/Groups) except the auth routes above.
  • GET /api/v1/oauth/authorize (when authenticated via Bearer)

• Public endpoints (no auth):

  • GET /health, GET /ready, GET /.well-known/jwks.json
  • POST /api/v1/auth/register, POST /api/v1/auth/login (CSRF required when cookies are sent)
  • OAuth: POST /oauth/token, GET /oauth/userinfo (token in form or Bearer)

OWASP alignment

• A01 Broken Access Control: JWT and API key validation; session bound to user/org; RBAC where applicable.
• A02 Cryptographic Failures: Passwords hashed (bcrypt/argon2); TOTP and webhook secrets encrypted at rest; TLS in production.
• A03 Injection: Input validation and parameterized queries; use of validator and prepared statements.
• A07 Identification and Authentication Failures: Lockout, MFA, secure session and refresh handling; OAuth PKCE and client_secret for confidential clients.
• CSRF: Double-submit cookie on cookie-based auth routes (see above).
• Secrets: No secrets in logs; client secret shown once on OAuth client create; webhook secrets encrypted.