Description
The CsrfGuard middleware applies to all state-changing HTTP methods (POST, PUT, DELETE, PATCH). While this is correct for management API routes (/api/*), it incorrectly blocks public-facing, OpenAI-compatible endpoints like POST /v1/chat/completions.
Standard LLM clients (OpenAI SDK, LangChain, etc.) do not support CSRF headers, leading to a csrf_missing error when attempting to use the gateway.
Affected Files
crates/infrastructure/transport-axum/src/middleware/csrf_guard.rs
Steps to Reproduce
- Start the server with CSRF enabled.
- Attempt a
POST /v1/chat/completions request using a valid API key but no CSRF token.
- Observe the
403 Forbidden response with csrf_missing.
Proposed Fix
The middleware should skip CSRF validation for any path starting with /v1/.
Description
The
CsrfGuardmiddleware applies to all state-changing HTTP methods (POST, PUT, DELETE, PATCH). While this is correct for management API routes (/api/*), it incorrectly blocks public-facing, OpenAI-compatible endpoints likePOST /v1/chat/completions.Standard LLM clients (OpenAI SDK, LangChain, etc.) do not support CSRF headers, leading to a
csrf_missingerror when attempting to use the gateway.Affected Files
crates/infrastructure/transport-axum/src/middleware/csrf_guard.rsSteps to Reproduce
POST /v1/chat/completionsrequest using a valid API key but no CSRF token.403 Forbiddenresponse withcsrf_missing.Proposed Fix
The middleware should skip CSRF validation for any path starting with
/v1/.