security: add CSRF protection to API billing endpoints #23

Open

Charon wants to merge 0 commits from feat/csrf-billing-endpoints into dev

Charon commented

2026-03-24 16:19:43 +00:00

Member

Summary

Add verified middleware to billing route group so only email-verified users can access billing endpoints
Separate read-only GET routes from state-changing POST routes with clear section comments
Add throttle:6,1 rate limiting (6 req/min) to state-changing endpoints: cancel, resume, upgrade/preview, upgrade

Fixes #13

Test plan

Verify unverified users receive 403 on all /commerce endpoints
Verify verified+authenticated users can access read-only GET endpoints normally
Verify POST endpoints (cancel, resume, upgrade, upgrade/preview) enforce the 6/min throttle
Verify webhook routes remain unaffected (no auth, signature-verified)

## Summary - Add `verified` middleware to billing route group so only email-verified users can access billing endpoints - Separate read-only GET routes from state-changing POST routes with clear section comments - Add `throttle:6,1` rate limiting (6 req/min) to state-changing endpoints: cancel, resume, upgrade/preview, upgrade Fixes #13 ## Test plan - [ ] Verify unverified users receive 403 on all `/commerce` endpoints - [ ] Verify verified+authenticated users can access read-only GET endpoints normally - [ ] Verify POST endpoints (cancel, resume, upgrade, upgrade/preview) enforce the 6/min throttle - [ ] Verify webhook routes remain unaffected (no auth, signature-verified)

This branch is already included in the target branch. There is nothing to merge.

View command line instructions

Checkout

From your project repository, check out a new branch and test the changes.

git fetch -u origin feat/csrf-billing-endpoints:feat/csrf-billing-endpoints

git checkout feat/csrf-billing-endpoints

Merge

Merge the changes and update on Forgejo.

Warning: The "Autodetect manual merge" setting is not enabled for this repository, you will have to mark this pull request as manually merged afterwards.

git checkout dev

git merge --no-ff feat/csrf-billing-endpoints

git checkout feat/csrf-billing-endpoints

git rebase dev

git checkout dev

git merge --ff-only feat/csrf-billing-endpoints

git checkout feat/csrf-billing-endpoints

git rebase dev

git checkout dev

git merge --no-ff feat/csrf-billing-endpoints

git checkout dev

git merge --squash feat/csrf-billing-endpoints