CSRF protection for cookie-based refresh #2075
Description
EPIC: Epic: Authentication & Session Management (JWT + Refresh) #2065
Overview
User Story:
As a system, I want to prevent CSRF attacks on endpoints that rely on cookies.
Action Items
Acceptance Criteria:
- Refresh/logout endpoints are protected by:
- SameSite cookie settings and/or
- CSRF token (double submit or header-based)
- Backend rejects refresh requests missing CSRF proof (if implemented).
Resources/Instructions
REPLACE THIS TEXT - If there is a website that has documentation that helps with this issue provide the link(s) here.