The latest updates on your projects. Learn more about Vercel for GitHub.

1 Skipped Deployment

Project	Deployment	Actions	Updated (UTC)
docs	Skipped		Jun 15, 2026 7:28pm

PR Summary

Medium Risk
Touches a high-impact execution endpoint and session auth, but the change is narrowly scoped to session cookies with early 403; legitimate same-origin UI runs and non-cookie callers should be unaffected.

Overview
Adds a CSRF guard on POST /api/workflows/[id]/execute for session-cookie auth only: after checkHybridAuth, provably cross-origin browser requests are rejected with 403 Access denied before workflow authorization or execution enqueue.

New helper isCrossOriginSessionRequest (lib/core/security/same-origin) treats anything other than Sec-Fetch-Site: same-origin as cross-origin, with an Origin same-origin fallback when Sec-Fetch-Site is missing; requests with neither header are allowed (documented as browser CSRF-only, not anti-forgery for non-browser clients). API key / public API / internal JWT paths are unchanged.

Coverage: 8 unit tests for the helper and a route test asserting cross-site session POSTs fail without calling authorize or enqueue.

^{Reviewed by Cursor Bugbot for commit 80c0ebf. Bugbot is set up for automated code reviews on this repo. Configure here.}

Greptile Summary

Adds a Fetch Metadata–based CSRF guard to POST /api/workflows/[id]/execute, scoped exclusively to session-cookie authentication. The guard uses Sec-Fetch-Site as the primary signal (only same-origin is trusted) and falls back to an Origin header check; when neither header is present the request is allowed (fail-open), which is intentional and safe because a genuine browser-driven CSRF attack cannot omit both headers.

• apps/sim/lib/core/security/same-origin.ts: New isCrossOriginSessionRequest utility — rejects anything other than same-origin on Sec-Fetch-Site, falls back to isSameOrigin() on Origin, and correctly wraps both paths in try/catch so a missing NEXT_PUBLIC_APP_URL cannot propagate.
• route.ts: Guard is injected immediately after checkHybridAuth, conditional on auth.success && auth.authType === AuthType.SESSION, so API-key, public-API, and internal-JWT callers are completely unaffected.
• Tests: 8-case unit suite in same-origin.test.ts and one route-level integration test added to route.async.test.ts; together they cover same-origin allow, same-site/cross-site/none reject, Origin fallback, no-headers allow, and header-precedence.

Confidence Score: 5/5

Safe to merge — the CSRF guard is correctly scoped to session auth, cannot block legitimate API-key or internal callers, and the fail-open behavior for header-less requests is intentional and documented in the code.

The guard logic, its tests, and the route integration are all consistent and correct. The only finding is a PR description that contradicts the actual behavior on two points (same-site and no-headers), which does not affect runtime behaviour.

No files require special attention.

Important Files Changed

Sequence Diagram

sequenceDiagram
    participant Browser as Browser (same-origin)
    participant Attacker as Attacker Site (CSRF)
    participant Script as Non-browser Client
    participant Route as POST /api/workflows/[id]/execute
    participant Auth as checkHybridAuth
    participant Guard as isCrossOriginSessionRequest
    participant Perm as authorizeWorkflow

    Browser->>Route: POST (Sec-Fetch-Site: same-origin, session cookie)
    Route->>Auth: checkHybridAuth → SESSION
    Route->>Guard: "secFetchSite === same-origin → false"
    Route->>Perm: proceed normally
    Perm-->>Browser: 200 OK

    Attacker->>Route: POST (Sec-Fetch-Site: cross-site, borrowed cookie)
    Route->>Auth: checkHybridAuth → SESSION
    Route->>Guard: "secFetchSite !== same-origin → true"
    Route-->>Attacker: 403 Access denied

    Script->>Route: POST (no Sec-Fetch-Site, no Origin, session cookie)
    Route->>Auth: checkHybridAuth → SESSION
    Route->>Guard: no headers → false (fail-open)
    Route->>Perm: proceed normally
    Perm-->>Script: 200 OK

    Note over Route,Guard: API-key / internal-JWT callers skip guard entirely

_{Reviews (2): Last reviewed commit: "fix(execute): scope session origin guard..." | Re-trigger Greptile}

@greptile review