From ffd15a5abbcc24dc2e331ce9990261b39f30cba9 Mon Sep 17 00:00:00 2001 From: Ayush7614 Date: Sat, 4 Jul 2026 05:36:06 +0530 Subject: [PATCH] Address Greptile review: CSRF and CSWSH guidance - Replace deprecated csurf reference with maintained CSRF patterns - Add SameSite caveat for cross-site WebSocket hijacking tests --- strix/skills/frameworks/express.md | 2 +- strix/skills/protocols/websocket.md | 2 ++ 2 files changed, 3 insertions(+), 1 deletion(-) diff --git a/strix/skills/frameworks/express.md b/strix/skills/frameworks/express.md index 40051bac..8a411826 100644 --- a/strix/skills/frameworks/express.md +++ b/strix/skills/frameworks/express.md @@ -109,7 +109,7 @@ Test `<%= 7*7 %>`, `${7*7}`, `{{7*7}}` depending on engine. ### CSRF Express has no built-in CSRF protection. -- `express-session` + cookie auth on POST/PUT/DELETE without `csurf` or double-submit token +- `express-session` + cookie auth on POST/PUT/DELETE without a maintained synchronizer-token or double-submit CSRF implementation - `SameSite=None` cookies without proper origin checks - CORS `credentials: true` with reflected origins diff --git a/strix/skills/protocols/websocket.md b/strix/skills/protocols/websocket.md index 0b6aeded..4262a248 100644 --- a/strix/skills/protocols/websocket.md +++ b/strix/skills/protocols/websocket.md @@ -66,6 +66,8 @@ Capture legitimate client traffic; map event names (`join`, `subscribe`, `messag Cross-Site WebSocket Hijacking: victim browser opens WS to target with victim's cookies because server doesn't validate `Origin`. +**SameSite caveat:** With `SameSite=Lax` or `Strict` session cookies, modern browsers usually withhold cookies on cross-site WebSocket handshakes — CSWSH PoCs may fail even when Origin validation is missing. Re-test with `SameSite=None` sessions and legacy clients. SameSite does not replace Origin checks for same-site subdomain attacks or token-in-query auth. + **Test:** ```html