fix(e2e): send Origin on /settings/profile POST so BUNYIP-259 CSRF middleware accepts it #296

Merged

YousifShkara merged 1 commit from fix/BUNYIP-286-e2e-profile-csrf-origin into main

2026-06-30 09:28:58 +02:00

YousifShkara commented

2026-06-30 08:40:25 +02:00

Owner

The account-profile spec drives POST /settings/profile via page.request (a Playwright request context, not a navigation, because /settings crashes swiftshader on the CI runner per BUNYIP-176). page.request shares the page's cookies + storageState but does NOT auto-populate Origin or Referer the way a real browser submitting a form does.

BUNYIP-259 added a CSRF middleware on bunyip-web that rejects every state-changing POST whose Origin / Referer host does not host-match the request Host. Without those headers the middleware fails closed and returns 403 with the body "Cross-origin request refused (CSRF)." That is the regression visible on CI: POST /settings/profile -> 403 on every retry.

Set Origin: env.baseURL and Referer: env.baseURL + '/settings' explicitly on the POST, mirroring exactly what a browser form submit from /settings would carry. The middleware host-matches them against Host and lets the request through; no test-only bypass and no CSRF-middleware exemption.

Leading spec comment updated to call out BUNYIP-259 and why the explicit headers are required for page.request-driven submissions on bunyip-web.

#BUNYIP-286

The account-profile spec drives `POST /settings/profile` via `page.request` (a Playwright request context, not a navigation, because /settings crashes swiftshader on the CI runner per BUNYIP-176). `page.request` shares the page's cookies + storageState but does NOT auto-populate `Origin` or `Referer` the way a real browser submitting a form does. BUNYIP-259 added a CSRF middleware on bunyip-web that rejects every state-changing POST whose Origin / Referer host does not host-match the request `Host`. Without those headers the middleware fails closed and returns 403 with the body "Cross-origin request refused (CSRF)." That is the regression visible on CI: `POST /settings/profile -> 403` on every retry. Set `Origin: env.baseURL` and `Referer: env.baseURL + '/settings'` explicitly on the POST, mirroring exactly what a browser form submit from /settings would carry. The middleware host-matches them against `Host` and lets the request through; no test-only bypass and no CSRF-middleware exemption. Leading spec comment updated to call out BUNYIP-259 and why the explicit headers are required for `page.request`-driven submissions on bunyip-web. #BUNYIP-286