fix: exempt /api/v1/errors from CSRF for frontend error logging

2026-07-26 12:24:31 +02:00
parent 808da564f3
commit b9d05e2198
1 changed files with 1 additions and 1 deletions
@@ -45,7 +45,7 @@ class CSRFMiddleware(BaseHTTPMiddleware):
            # 2. CSRF token validation (double-submit pattern)
            # Skip CSRF token check for auth endpoints (login/password-reset)
            path = request.url.path
-            if path.endswith("/auth/login") or path.endswith("/auth/logout") or "/password-reset" in path:
+            if path.endswith("/auth/login") or path.endswith("/auth/logout") or "/password-reset" in path or path.endswith("/api/v1/errors") or path == "/api/v1/errors":
                return await call_next(request)

            csrf_header = request.headers.get("x-csrf-token")