From 9370fb36f2d376459d566412c624e253c195cf0c Mon Sep 17 00:00:00 2001 From: Lilleman auf Larv Date: Fri, 30 Oct 2026 21:32:56 +0100 Subject: [PATCH] =?UTF-8?q?Answer=20prose=20round=201:=200=20=F0=9F=94=B4,?= =?UTF-8?q?=205=20=F0=9F=9F=A1=20(0=20misread);=20tighten=20the=20CSRF=20n?= =?UTF-8?q?otes?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- AGENTS.md | 7 +++---- 1 file changed, 3 insertions(+), 4 deletions(-) diff --git a/AGENTS.md b/AGENTS.md index 92f2c58..1436ff9 100644 --- a/AGENTS.md +++ b/AGENTS.md @@ -221,10 +221,9 @@ Revisit only if the stated reason stops holding. adds you to any group, including one holding every permission; `users:write` mints a recovery code for any account. The containment the split buys is real on the **read** half only (`users:read` is a safe helpdesk grant). Don't let the per-resource naming imply otherwise in docs. -- **The CSRF token is deliberately unbound to the session** (`src/auth/csrf.ts`): it is a signed - double-submit token, so an attacker who can write cookies on the origin can fix a token they know. - Accepted — standard for the unbound form, and `SameSite=Lax` plus HSTS cover it. **Valid while the - session cookie stays `SameSite=Lax` or stricter.** +- **The CSRF token is deliberately unbound to the session** (`src/auth/csrf.ts`; README → Security + model): the usual cost of a signed double-submit token, covered by `SameSite=Lax` and HSTS. + **Valid while the session cookie stays `SameSite=Lax` or stricter.** - **Plainpages says "user" everywhere; Ory's word is "identity".** House style, not a renamed concept. The single exception is the `Identity` DTO in `src/auth/kratos-admin.ts`, which mirrors Kratos' wire shape — don't rename it.