The latest updates on your projects. Learn more about Vercel for GitHub.

1 Skipped Deployment

Project	Deployment	Actions	Updated (UTC)
docs	Skipped		Jun 15, 2026 8:11pm

PR Summary

Medium Risk
Touches authentication on a high-traffic execution endpoint; mis-tuning fetch-site rules could block legitimate runs or weaken CSRF protection, though scope is limited to session auth and behavior is heavily tested.

Overview
Re-lands a session-cookie CSRF guard on POST /api/workflows/[id]/execute, blocking only requests where the browser reports Sec-Fetch-Site: cross-site. Session-authenticated runs that are same-origin, same-site (e.g. www → apex), none, or missing the header still proceed; API key, public API, and internal JWT paths are unchanged.

A new helper isCrossSiteSessionRequest centralizes that check (replacing a stricter same-origin-only approach that broke multi-subdomain Run). The route returns 403 Access denied immediately after hybrid auth, before authorization or queuing. Unit and route tests cover cross-site rejection and same-site async acceptance.

^{Reviewed by Cursor Bugbot for commit 79160d7. Bugbot is set up for automated code reviews on this repo. Configure here.}

Greptile Summary

This PR re-lands the session-cookie CSRF guard on POST /api/workflows/[id]/execute, fixing the regression from #5062 which incorrectly blocked same-site requests and broke Run on multi-subdomain deployments. The guard now only rejects requests where Sec-Fetch-Site: cross-site is explicitly set, while allowing same-origin, same-site, none, and absent headers.

• apps/sim/lib/core/security/same-origin.ts: New utility isCrossSiteSessionRequest — a single-line header check scoped to the browser's unforgeable Sec-Fetch-Site header, with thorough JSDoc explaining the same-site allowance and the known non-browser limitation.
• apps/sim/app/api/workflows/[id]/execute/route.ts: Guard is placed after checkHybridAuth (intentional — auth type must be known first) and fires only for AuthType.SESSION, leaving API-key, public-API, and internal-JWT paths untouched.
• Tests: Five unit tests on the helper and two new route-level integration tests — one covering the cross-site → 403 path and one covering the same-site → 202 regression scenario.

Confidence Score: 4/5

Safe to merge — the guard is narrowly scoped to session-authenticated execute calls and the same-site allowance is correctly preserved to avoid repeating the staging regression.

The core logic is a single-line header comparison with thorough tests. The only non-trivial design point is that session validation runs before the CSRF check, meaning a valid session cookie is still looked up even for requests the guard will ultimately reject — a minor efficiency trade-off, not a correctness issue.

No files require special attention; the route change is small and well-isolated.

Important Files Changed

Sequence Diagram

sequenceDiagram
    participant Browser
    participant ExecuteRoute as POST /execute
    participant HybridAuth as checkHybridAuth
    participant CSRFGuard as isCrossSiteSessionRequest
    participant WorkflowAuthz as authorizeWorkflow

    Browser->>ExecuteRoute: POST (with session cookie)
    ExecuteRoute->>HybridAuth: checkHybridAuth(req)
    HybridAuth-->>ExecuteRoute: "{ success, authType, userId }"

    alt "authType === SESSION"
        ExecuteRoute->>CSRFGuard: isCrossSiteSessionRequest(req)
        alt Sec-Fetch-Site: cross-site
            CSRFGuard-->>ExecuteRoute: true
            ExecuteRoute-->>Browser: 403 Access denied
        else "same-origin | same-site | none | absent"
            CSRFGuard-->>ExecuteRoute: false
            ExecuteRoute->>WorkflowAuthz: authorizeWorkflowByWorkspacePermission(...)
            WorkflowAuthz-->>ExecuteRoute: "{ allowed, workflow }"
            ExecuteRoute-->>Browser: 200/202 execution result
        end
    else API_KEY / INTERNAL_JWT / PUBLIC_API
        Note over ExecuteRoute: CSRF guard skipped
        ExecuteRoute->>WorkflowAuthz: authorizeWorkflowByWorkspacePermission(...)
        WorkflowAuthz-->>ExecuteRoute: "{ allowed, workflow }"
        ExecuteRoute-->>Browser: 200/202 execution result
    end

_{Reviews (1): Last reviewed commit: "fix(execute): reject only cross-site ses..." | Re-trigger Greptile}