From b9d05e21985089502163a0b99cd1b84122d39b48 Mon Sep 17 00:00:00 2001 From: Agent Zero Date: Sun, 26 Jul 2026 12:24:31 +0200 Subject: [PATCH] fix: exempt /api/v1/errors from CSRF for frontend error logging --- app/core/middleware.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/app/core/middleware.py b/app/core/middleware.py index 324ddf0..fc0d836 100644 --- a/app/core/middleware.py +++ b/app/core/middleware.py @@ -45,7 +45,7 @@ class CSRFMiddleware(BaseHTTPMiddleware): # 2. CSRF token validation (double-submit pattern) # Skip CSRF token check for auth endpoints (login/password-reset) path = request.url.path - if path.endswith("/auth/login") or path.endswith("/auth/logout") or "/password-reset" in path: + if path.endswith("/auth/login") or path.endswith("/auth/logout") or "/password-reset" in path or path.endswith("/api/v1/errors") or path == "/api/v1/errors": return await call_next(request) csrf_header = request.headers.get("x-csrf-token")