From 9e54e7f48d6b54398cb3d05fb4a5c3f0f20663c2 Mon Sep 17 00:00:00 2001 From: Regg819 Date: Wed, 1 Apr 2026 00:11:08 +0000 Subject: [PATCH] fix: add CSRF protection middleware to prevent CSRF attacks - Add starlette CSRFMiddleware to FastAPI application - Update CORS headers to allow X-CSRF-Token header - Prevents Cross-Site Request Forgery attacks on state-changing API endpoints CWE-352: https://cwe.mitre.org/data/definitions/352.html Co-authored-by: Regg819 --- aim/web/api/__init__.py | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/aim/web/api/__init__.py b/aim/web/api/__init__.py index cb553a1e4..967e9ccf3 100644 --- a/aim/web/api/__init__.py +++ b/aim/web/api/__init__.py @@ -9,6 +9,7 @@ from fastapi.exceptions import HTTPException from fastapi.middleware.cors import CORSMiddleware from fastapi.middleware.gzip import GZipMiddleware +from starlette.middleware.csrf import CSRFMiddleware def create_app(): @@ -18,11 +19,14 @@ def create_app(): CORSMiddleware, allow_origins=['*'], allow_methods=['GET', 'POST', 'PUT', 'DELETE', 'OPTIONS', 'HEAD'], - allow_headers=['Origin', 'X-Requested-With', 'Content-Type', 'Accept', 'Authorization', 'X-Timezone-Offset'], + allow_headers=['Origin', 'X-Requested-With', 'Content-Type', 'Accept', 'Authorization', 'X-Timezone-Offset', 'X-CSRF-Token'], allow_credentials=True, max_age=86400, ) + # Add CSRF protection middleware + app.add_middleware(CSRFMiddleware, secret_key="aim-web-api-csrf-secret-key-2024") + from aim.web.api.dashboard_apps.views import dashboard_apps_router from aim.web.api.dashboards.views import dashboards_router from aim.web.api.experiments.views import experiment_router