Repair CSRF Session Boundary Bugs

The problem

CSRF and session handling often break due to inconsistent state ownership, race conditions in multi-tab environments, or mismatched trust boundaries across components. Manually tracing these leaky abstractions leads to regression bugs or accidental security downgrades.

What it does

• Identifies and repairs inconsistent CSRF token binding and session rotation logic.
• Reconstructs concurrent timelines to fix race conditions in multi-tab behavior and token consumption.
• Relocates validation logic to occur before irreversible state mutations or dispatches.
• Synchronizes Origin, Referer, and SameSite policies across the entire repository.
• Generates deterministic local test fixtures and redacted observability metrics for regression testing.

Why this beats prompting it yourself

General prompts often suggest "quick fixes" like disabling validation or increasing timeouts, which introduce security risks. This skill enforces strict safety rules that preserve existing authentication policies and session lifetimes while ensuring repairs are verifiable through local loopback tests.

Use cases

• Fixing 403 Forbidden errors caused by CSRF token expiration in multi-tab web apps.
• Hardening session boundaries during login/logout state transitions.
• Aligning SameSite cookie attributes with modern browser security requirements.
• Adding redacted logging to session lifecycle events for easier debugging.

Known limitations

Operates strictly on repository files and local fixtures. Cannot access production services, live secrets, or customer data.