From ad06e2ffd5ac8a381336e5d890647cd588897710 Mon Sep 17 00:00:00 2001 From: Meta Vens Date: Sun, 11 Oct 2026 04:43:45 +0200 Subject: [PATCH] Heimdall completion route: no antiforgery opt-out (the form is read by hand); pin a malformed form body Co-Authored-By: Claude Opus 5.5 --- src/Bifrost.Web/Program.cs | 2 +- tests/Bifrost.Web.Tests/HeimdallCompletionTests.cs | 4 ++++ 2 files changed, 5 insertions(+), 1 deletion(-) diff --git a/src/Bifrost.Web/Program.cs b/src/Bifrost.Web/Program.cs index 3d7beaa..4bb73ac 100644 --- a/src/Bifrost.Web/Program.cs +++ b/src/Bifrost.Web/Program.cs @@ -550,7 +550,7 @@ app.MapPost("/auth/heimdall/complete", async ( return Results.Redirect(HeimdallAuthService.ErrorRedirect); } -}).AllowAnonymous().DisableAntiforgery(); +}).AllowAnonymous(); app.MapPost("/auth/sign-out", async (HttpContext httpContext) => { diff --git a/tests/Bifrost.Web.Tests/HeimdallCompletionTests.cs b/tests/Bifrost.Web.Tests/HeimdallCompletionTests.cs index 21a26f8..2aef4a7 100644 --- a/tests/Bifrost.Web.Tests/HeimdallCompletionTests.cs +++ b/tests/Bifrost.Web.Tests/HeimdallCompletionTests.cs @@ -679,6 +679,10 @@ public sealed class HeimdallCompletionTests "/auth/heimdall/complete", new StringContent("{\"attempt\":\"x\"}", Encoding.UTF8, "application/json")); results.Add(("json body", new CompletionResult(json, false), "Heimdall completion has no attempt for this browser.")); + using var malformed = await client.PostAsync( + "/auth/heimdall/complete", + new StringContent("not a multipart body", Encoding.UTF8, "multipart/form-data")); + results.Add(("malformed form", new CompletionResult(malformed, false), "Heimdall completion has no attempt for this browser.")); foreach (var (name, result, reason) in results) {