CSRF Token Protection for Mutating API Routes

[Kingsman-99]

Description

All POST, PUT, PATCH, and DELETE API routes currently accept requests without verifying that they originate from the app's own frontend, making them vulnerable to cross-site request forgery. Adding CSRF token validation closes this attack vector without breaking the existing wallet-based authentication flow.

Technical Context

A CSRF token utility at src/lib/csrf.ts generates and validates tokens using the crypto Web API (crypto.randomUUID + HMAC-SHA256 with a CSRF_SECRET environment variable). A server-side helper src/lib/middleware/csrfMiddleware.ts validates the X-CSRF-Token header on all mutating routes (e.g., src/app/api/invoices/route.ts, src/app/api/recipients/route.ts). A client-side hook src/hooks/useCsrfToken.ts fetches the token from GET /api/csrf and injects it into all fetch calls via a centralized src/lib/apiClient.ts wrapper.

Acceptance Criteria

• All mutating API routes return 403 Forbidden when the X-CSRF-Token header is absent or invalid
• GET /api/csrf returns a fresh signed token that is valid for exactly 60 minutes
• The useCsrfToken hook automatically refreshes the token before expiry and retries the queued request transparently
• The CSRF secret is loaded from process.env.CSRF_SECRET; the app fails to start at build time if the variable is missing
• Wallet-connect flows and read-only GET routes are unaffected and require no token
• All CI checks (npm test, npm run build, ESLint/TypeScript) pass and the branch has no merge conflicts

---

[apatafamilycompound123-ops]

Hello Maintainer, I'd like to work on this issue. I have experience with blockchain development and state management, and I can implement this. Please consider assigning it to me.

[NoahJoseph-ux]

@NoahJoseph-ux has applied to work on this issue as part of the Stellar Wave Program's 7th wave.

Hello Maintainer, I’ve thoroughly read through the requirements and understand the expected outcome. I’d be happy to take this on if you can assign it to me

ℹ️ Repo Maintainers: To accept this application, review their application or assign @NoahJoseph-ux to this issue.

[David-Savio]

@David-Savio has applied to work on this issue as part of the Stellar Wave Program's 7th wave.

Hi maintainer. I will resolve this issue quickly, If it's assigned to me. Thank you.

ℹ️ Repo Maintainers: To accept this application, review their application or assign @David-Savio to this issue.

[Bayovictor]

@Bayovictor has applied to work on this issue as part of the Stellar Wave Program's 7th wave.

Hi, Please I would like to work on this issue

ℹ️ Repo Maintainers: To accept this application, review their application or assign @Bayovictor to this issue.

[deslawson]

@deslawson has applied to work on this issue as part of the Stellar Wave Program's 7th wave.

Id love to work on this

ℹ️ Repo Maintainers: To accept this application, review their application or assign @deslawson to this issue.

[chiprime]

@chiprime has applied to work on this issue as part of the Stellar Wave Program's 7th wave.

Hello Maintainer, I can fix this issue.
Please assign me.

ℹ️ Repo Maintainers: To accept this application, review their application or assign @chiprime to this issue.

[MJigah]

@MJigah has applied to work on this issue as part of the Stellar Wave Program's 7th wave.

I would like to work on this account

ℹ️ Repo Maintainers: To accept this application, review their application or assign @MJigah to this issue.

[drips-wave]

Congratulations, @MJigah! 🎉 Your application was accepted by the repo's maintainers, and the issue is due on July 30, 2026.

🧑‍💻 @MJigah: Please resolve the issue such that the repo's maintainers have enough time to review your contribution before the due date. You'll earn Points for completing the issue on-time, which will make you eligible for a share of the Stellar Wave Program's reward pool.

Warning

When opening a PR, please link it to this issue to ensure it gets tracked accurately. Points are awarded when this issue is marked as completed by the maintainer.

🤠 Repo maintainers: Please keep an eye on the contributor's progress and review their work before the due date. You can manage this issue, including adjusting its complexity and points, here.

🌊 Happy Wave 🌊