Set Cache-Control on every rendered page, and record the CSRF token's unbinding

2026-10-30 21:28:14 +01:00
parent 0c0a3bc905
commit 1dfc6aac3a
8 changed files with 73 additions and 24 deletions
@@ -221,6 +221,10 @@ Revisit only if the stated reason stops holding.
  adds you to any group, including one holding every permission; `users:write` mints a recovery code
  for any account. The containment the split buys is real on the **read** half only (`users:read` is
  a safe helpdesk grant). Don't let the per-resource naming imply otherwise in docs.
+- **The CSRF token is deliberately unbound to the session** (`src/auth/csrf.ts`): it is a signed
+  double-submit token, so an attacker who can write cookies on the origin can fix a token they know.
+  Accepted — standard for the unbound form, and `SameSite=Lax` plus HSTS cover it. **Valid while the
+  session cookie stays `SameSite=Lax` or stricter.**
 - **Plainpages says "user" everywhere; Ory's word is "identity".** House style, not a renamed
  concept. The single exception is the `Identity` DTO in `src/auth/kratos-admin.ts`, which mirrors
  Kratos' wire shape — don't rename it.