fix(e2e): send Origin on profile POST so CSRF middleware admits it #297

Merged

Claude-Run merged 1 commit from fix/BUNYIP-284-e2e-profile-csrf-origin into main

2026-06-30 08:50:26 +02:00

Claude-Run commented

2026-06-30 08:40:48 +02:00

Member

The account-ui profile spec posts /settings/profile over page.request.post, which sends no Origin header. BUNYIP-259 (PR #291) added an Origin/Referer-matching CSRF middleware to bunyip-web that fails closed (403) on any state-changing POST whose Origin does not match the BFF host, so the stand-in request the spec uses for the (CI-unrenderable) browser form was rejected with 403 on every attempt.

A real browser form submission carries Origin: <web origin>, which matches Host and passes the check. This spec exists precisely because /settings cannot be rendered on the GPU-less CI runner, so it must replicate that header itself. Set Origin: new URL(env.baseURL).origin on the POST and refresh the stale comment that claimed no CSRF handling was needed. The read-only GET /settings re-fetch is unaffected (the middleware skips GET).

#BUNYIP-284

The account-ui profile spec posts `/settings/profile` over `page.request.post`, which sends no `Origin` header. BUNYIP-259 (PR #291) added an `Origin`/`Referer`-matching CSRF middleware to bunyip-web that fails closed (403) on any state-changing POST whose `Origin` does not match the BFF host, so the stand-in request the spec uses for the (CI-unrenderable) browser form was rejected with 403 on every attempt. A real browser form submission carries `Origin: <web origin>`, which matches Host and passes the check. This spec exists precisely because `/settings` cannot be rendered on the GPU-less CI runner, so it must replicate that header itself. Set `Origin: new URL(env.baseURL).origin` on the POST and refresh the stale comment that claimed no CSRF handling was needed. The read-only `GET /settings` re-fetch is unaffected (the middleware skips GET). #BUNYIP-284

Claude-Run added 1 commit

2026-06-30 08:40:48 +02:00

fix(e2e): send Origin on profile POST so CSRF middleware admits it

E2E / Playwright against deployment (pull_request) Successful in 23s

Details

Check / fmt + clippy + build + tests (pull_request) Successful in 9m33s

Details

Create release / Create release from merged PR (pull_request) Has been skipped

Details

6d6ed3856a

The account-ui profile spec posts `/settings/profile` over `page.request.post`, which sends no `Origin` header. BUNYIP-259 (PR #291) added an `Origin`/`Referer`-matching CSRF middleware to bunyip-web that fails closed (403) on any state-changing POST whose `Origin` does not match the BFF host, so the stand-in request the spec uses for the (CI-unrenderable) browser form was rejected with 403 on every attempt.

A real browser form submission carries `Origin: <web origin>`, which matches Host and passes the check. This spec exists precisely because `/settings` cannot be rendered on the GPU-less CI runner, so it must replicate that header itself. Set `Origin: new URL(env.baseURL).origin` on the POST and refresh the stale comment that claimed no CSRF handling was needed. The read-only `GET /settings` re-fetch is unaffected (the middleware skips GET).

#BUNYIP-284