Phase 3: WebSocket CSRF, SameSite=Lax, Tenant FK CASCADE

app/core/auth.py

@@ -116,8 +116,23 @@ def verify_ws_origin(websocket) -> bool:
     # CSRF token validation: check query parameter 'csrf_token' against session
     # The frontend must send ?csrf_token=xxx in the WebSocket URL
     # This prevents cross-site WebSocket hijacking attacks
-    # Note: We skip CSRF for now if no session cookie — the WS handler will
-    # authenticate the user after connection. Origin check is the primary defense.
+    csrf_token = websocket.query_params.get("csrf_token", "")
+    if not csrf_token:
+        logger.warning("WebSocket connection rejected: missing csrf_token query parameter")
+        return False
+
+    # Validate CSRF token against session in Redis
+    session_id = websocket.cookies.get(settings.session_cookie_name)
+    if not session_id:
+        logger.warning("WebSocket connection rejected: missing session cookie")
+        return False
+
+    redis = get_redis()
+    session_data = await get_session_data(redis, session_id)
+    if not session_data or session_data.get("csrf_token") != csrf_token:
+        logger.warning("WebSocket connection rejected: invalid CSRF token")
+        return False
+
     return True