Skip to content

fix(workflow): send CSRF tokens from React mutations - #3549

Merged
kojiwakayama merged 3 commits into
mainfrom
fix/workflow-csrf-headers
Aug 10, 2026
Merged

fix(workflow): send CSRF tokens from React mutations#3549
kojiwakayama merged 3 commits into
mainfrom
fix/workflow-csrf-headers

Conversation

@kojiwakayama

@kojiwakayama kojiwakayama commented Aug 10, 2026

Copy link
Copy Markdown
Contributor

Summary

  • reflect the production CSRF cookie into workflow mutation requests
  • cover start, approval, cancel, and retry through one browser-only helper
  • keep GET requests, server rendering, and fail-closed server validation unchanged
  • add React hook regressions for every affected mutation

Root cause

Production enables double-submit CSRF protection by default and issues a readable __Host-vf_csrf cookie. The public workflow React hooks sent POST requests without the matching x-csrf-token header, so the generated agentic-workflow template rendered correctly but every real Start action returned 403.

Verification

  • red: generated production page Start button returned HTTP 403 and the focused hook assertion received no CSRF header
  • green: focused hook suite passed, 2 regression steps covering start, approval, cancel, and retry
  • formatting, lint, and typecheck passed
  • npm distributable build passed
  • generated Node agentic-workflow passed scaffold, install, build, production serve, root and nested routes, real browser form submission, workflow list/detail checks, and graceful shutdown
  • full pre-push checks passed: 3775 parallel unit tests (27915 steps), 10 isolated CWD tests (193 steps), and 2 cross-file CWD exclusion tests

Related: veryfront/veryfront-issue-inbox#456

@kojiwakayama
Keep production workflow controls compatible with CSRF defaults
0cd9faf 
Production enables double-submit CSRF protection by default, while the public workflow React hooks previously sent mutation requests without reflecting the issued cookie into the request header. Centralize that browser-only header behavior and use it for every workflow mutation.

Constraint: Preserve fail-closed server behavior and avoid changing GET requests or non-browser execution.
Rejected: Disable CSRF for generated workflow routes | weakens the production security default.
Confidence: high
Scope-risk: narrow
Reversibility: clean
Directive: New workflow mutation hooks must use workflowMutationHeaders.
Tested: Focused React hook regression, fmt, lint, typecheck, npm package build, generated Node agentic-workflow scaffold/install/build/serve/browser/API journey.
Not-tested: Full template/runtime matrix pending after this commit.
@coderabbitai

coderabbitai Bot commented Aug 10, 2026 •
edited
Loading

Copy link
Copy Markdown

Warning

Review limit reached

@kojiwakayama, you've reached your PR review limit, so we couldn't start this review.

Next review available in: 10 minutes

Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available.
You're only billed for reviews past your plan's rate limits ($0.25/file).

How can I continue?

After more reviews become available, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews.

How do review limits work?

CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability.

For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window.

Please refer docs for additional details.

Review details
⚙️ Run configuration

Configuration used: Repository UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 631812a1-b8cc-4f35-b4f4-29bbd32db2e1

📥 Commits

Reviewing files that changed from the base of the PR and between 80fb3a0 and f5ba53c.

📒 Files selected for processing (6)
  • docs/api-reference/veryfront/workflow.md
  • src/workflow/react/mutation-headers.ts
  • src/workflow/react/use-approval.ts
  • src/workflow/react/use-workflow-start.test.tsx
  • src/workflow/react/use-workflow-start.ts
  • src/workflow/react/use-workflow.ts

Comment @coderabbitai help to get the list of available commands.

chatgpt-codex-connector[bot]
chatgpt-codex-connector Bot reviewed Aug 10, 2026
View reviewed changes

@chatgpt-codex-connector chatgpt-codex-connector Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 0cd9faf23d

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

Comment thread src/workflow/react/mutation-headers.ts
@kojiwakayama
fix(workflow): keep CSRF tokens same-origin
78bbb07
@kojiwakayama
Keep workflow API references aligned with CSRF hooks
f5ba53c 
The production mutation fix shifted public workflow React declarations, so the generated reference must track their current source locations.

Constraint: Generate with the CI-pinned Deno 2.7.7 to avoid version-dependent source-location churn.

Confidence: high

Scope-risk: narrow

Reversibility: clean

Tested: npx -y deno@2.7.7 task docs:api-reference:check

Not-tested: No behavior changes in this documentation-only commit.
@kojiwakayama

kojiwakayama commented Aug 10, 2026

Copy link
Copy Markdown
Contributor Author

@codex review

@chatgpt-codex-connector

chatgpt-codex-connector Bot commented Aug 10, 2026

Copy link
Copy Markdown

Codex Review: Didn't find any major issues. Nice work!

Reviewed commit: 78bbb07b6b

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

@kojiwakayama

kojiwakayama commented Aug 10, 2026

Copy link
Copy Markdown
Contributor Author

@codex review

@chatgpt-codex-connector

chatgpt-codex-connector Bot commented Aug 10, 2026

Copy link
Copy Markdown

Codex Review: Didn't find any major issues. Delightful!

Reviewed commit: f5ba53c1d4

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

@kojiwakayama
kojiwakayama added this pull request to the merge queue Aug 10, 2026
Merged via the queue into main with commit ad255fe Aug 10, 2026
33 checks passed
@kojiwakayama
kojiwakayama deleted the fix/workflow-csrf-headers branch August 10, 2026 18:32
@kwakayama kwakayama mentioned this pull request Aug 10, 2026
Merged
@kojiwakayama kojiwakayama mentioned this pull request Aug 12, 2026
Merged
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@chatgpt-codex-connector chatgpt-codex-connector[bot] chatgpt-codex-connector[bot] left review comments
@kwakayama kwakayama Awaiting requested review from kwakayama kwakayama is a code owner

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@kojiwakayama