fix: use hex CSRF tokens + add server-side debug logging

Codex · Codex · commit 6171becdaa4d · 2026-03-24T00:03:33.000-07:00
- Switch from base64 to hex tokens (no special chars that break cookie parsing)
- Simpler JS cookie reader (no decodeURIComponent needed)
- Add server-side log for CSRF rejections showing header vs cookie values
- Verified all 6 POST endpoints pass CSRF validation
diff --git a/internal/web/csrf.go b/internal/web/csrf.go
@@ -2,7 +2,8 @@ package web
 
 import (
 	"crypto/rand"
-	"encoding/base64"
+	"encoding/hex"
+	"log"
 	"net/http"
 )
 
@@ -35,6 +36,7 @@ func CSRFMiddleware(next http.Handler) http.Handler {
 			// Mutation methods — validate token
 			cookie, err := r.Cookie(csrfCookieName)
 			if err != nil || cookie.Value == "" {
+				log.Printf("CSRF reject %s %s: cookie missing (err=%v)", r.Method, r.URL.Path, err)
 				http.Error(w, "CSRF cookie missing", http.StatusForbidden)
 				return
 			}
@@ -43,6 +45,7 @@ func CSRFMiddleware(next http.Handler) http.Handler {
 				headerToken = r.FormValue("csrf_token")
 			}
 			if headerToken != cookie.Value {
+				log.Printf("CSRF reject %s %s: token mismatch (header=%q cookie=%q)", r.Method, r.URL.Path, headerToken, cookie.Value)
 				http.Error(w, "CSRF token mismatch", http.StatusForbidden)
 				return
 			}
@@ -64,5 +67,5 @@ func GetCSRFToken(r *http.Request) string {
 func generateCSRFToken() string {
 	b := make([]byte, csrfTokenLength)
 	rand.Read(b)
-	return base64.URLEncoding.EncodeToString(b)
+	return hex.EncodeToString(b)
 }
diff --git a/internal/web/templates/layout.templ b/internal/web/templates/layout.templ
@@ -14,10 +14,14 @@ templ Layout(title string, csrfToken string, isManager bool, activePage string)
 		<body>
 			<script>
 				document.body.addEventListener('htmx:configRequest', function(e) {
-					// Read CSRF token from cookie (double-submit cookie pattern)
-					var match = document.cookie.match(/(^|;\s*)_csrf=([^;]*)/);
-					if (match) {
-						e.detail.headers['X-CSRF-Token'] = decodeURIComponent(match[2]);
+					// Read CSRF token from _csrf cookie (double-submit cookie pattern)
+					var cookies = document.cookie.split(';');
+					for (var i = 0; i < cookies.length; i++) {
+						var c = cookies[i].trim();
+						if (c.indexOf('_csrf=') === 0) {
+							e.detail.headers['X-CSRF-Token'] = c.substring(6);
+							break;
+						}
 					}
 				});
 			</script>
diff --git a/internal/web/templates/layout_templ.go b/internal/web/templates/layout_templ.go

Original file line number	Diff line number	Diff line change
`@@ -2,7 +2,8 @@ package web`
`2`	`2`
`3`	`3`	`import (`
`4`	`4`	`"crypto/rand"`
`5`		`- "encoding/base64"`
	`5`	`+ "encoding/hex"`
	`6`	`+ "log"`
`6`	`7`	`"net/http"`
`7`	`8`	`)`
`8`	`9`
`@@ -35,6 +36,7 @@ func CSRFMiddleware(next http.Handler) http.Handler {`
`35`	`36`	`// Mutation methods — validate token`
`36`	`37`	`cookie, err := r.Cookie(csrfCookieName)`
`37`	`38`	`if err != nil \|\| cookie.Value == "" {`
	`39`	`+ log.Printf("CSRF reject %s %s: cookie missing (err=%v)", r.Method, r.URL.Path, err)`
`38`	`40`	`http.Error(w, "CSRF cookie missing", http.StatusForbidden)`
`39`	`41`	`return`
`40`	`42`	`}`
`@@ -43,6 +45,7 @@ func CSRFMiddleware(next http.Handler) http.Handler {`
`43`	`45`	`headerToken = r.FormValue("csrf_token")`
`44`	`46`	`}`
`45`	`47`	`if headerToken != cookie.Value {`
	`48`	`+ log.Printf("CSRF reject %s %s: token mismatch (header=%q cookie=%q)", r.Method, r.URL.Path, headerToken, cookie.Value)`
`46`	`49`	`http.Error(w, "CSRF token mismatch", http.StatusForbidden)`
`47`	`50`	`return`
`48`	`51`	`}`
`@@ -64,5 +67,5 @@ func GetCSRFToken(r *http.Request) string {`
`64`	`67`	`func generateCSRFToken() string {`
`65`	`68`	`b := make([]byte, csrfTokenLength)`
`66`	`69`	`rand.Read(b)`
`67`		`- return base64.URLEncoding.EncodeToString(b)`
	`70`	`+ return hex.EncodeToString(b)`
`68`	`71`	`}`