Add authentication + CSRF protection to all mutating routes #5

New Issue

tonym · 2026-06-06T19:58:10Z

tonym commented

2026-06-06 19:58:10 +00:00

Severity: high
Category: security
Location: app.py (all POST routes)

Problem

The app has no auth at all and no CSRF tokens. Any device on the LAN can add/wipe financial records via a single POST, and a cross-origin page can mutate data silently.

Suggested fix

Add Basic Auth (reverse proxy or Flask-HTTPAuth) with a single env-stored password, and Flask-WTF CSRF on all forms.

Filed by automated code review.

**Severity:** high **Category:** security **Location:** `app.py (all POST routes)` ### Problem The app has no auth at all and no CSRF tokens. Any device on the LAN can add/wipe financial records via a single POST, and a cross-origin page can mutate data silently. ### Suggested fix Add Basic Auth (reverse proxy or Flask-HTTPAuth) with a single env-stored password, and Flask-WTF CSRF on all forms. _Filed by automated code review._

tonym added the

security

severity:high

labels 2026-06-06 19:58:10 +00:00

tonym referenced this issue from a commit

2026-06-06 23:03:11 +00:00

Add WebAuthn passkey auth (dormant behind AUTH_ENABLED)

Sign in to join this conversation.