secret links: set csrf token for all requests with secret links

* closes inveniosoftware/invenio-app-rdm#2684
inveniosoftware · May 31, 2024 · cfac803 · cfac803
1 parent 121aa75
commit cfac803
Showing 1 changed file with 3 additions and 0 deletions.
diff --git a/invenio_rdm_records/utils.py b/invenio_rdm_records/utils.py
@@ -106,6 +106,9 @@ def verify_token(identity):
             data = SecretLink.load_token(token)
             if data:
                 identity.provides.add(LinkNeed(data["id"]))
+                # In order for anonymous users with secret link to perform vulnerable HTTP requests
+                # ("POST", "PUT", "PATCH", "DELETE"), CSRF token must be set
+                request.csrf_cookie_needs_reset = True
             session[secret_link_token_arg] = token
             has_secret_link_token = True
         except SignatureExpired: