From c45aba365230a2e03cda13c8acb92647968c8fec Mon Sep 17 00:00:00 2001 From: Seokju Na Date: Thu, 2 Jul 2026 00:30:53 +0900 Subject: [PATCH 1/2] chore: add CSRF middleware for server functions MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Silence the TanStack Start warning by protecting server-function RPC endpoints with the recommended CSRF middleware (same-origin check, scoped to serverFn requests), composed with the existing Sentry middleware. Low-risk here — the only server function is the read-only docs page loader with no auth or mutations — but the fix is trivial, follows the framework's recommendation, and covers any state-changing server function added later. Verified: build/lint pass, the warning is gone, and docs pages still load. Co-Authored-By: Claude Opus 4.8 (1M context) Claude-Session: https://claude.ai/code/session_01HhaZ2zL7bAqT3c8mRWTSs9 --- src/start.ts | 10 ++++++++-- 1 file changed, 8 insertions(+), 2 deletions(-) diff --git a/src/start.ts b/src/start.ts index ace8d04..a3d9aff 100644 --- a/src/start.ts +++ b/src/start.ts @@ -2,11 +2,17 @@ import { sentryGlobalFunctionMiddleware, sentryGlobalRequestMiddleware, } from '@sentry/tanstackstart-react'; -import { createStart } from '@tanstack/react-start'; +import { createCsrfMiddleware, createStart } from '@tanstack/react-start'; + +// Server functions are same-origin RPC endpoints; reject cross-site requests to +// them (same-origin check via Sec-Fetch-Site / Origin, with a Referer fallback). +const csrfMiddleware = createCsrfMiddleware({ + filter: ctx => ctx.handlerType === 'serverFn', +}); export const startInstance = createStart(() => { return { - requestMiddleware: [sentryGlobalRequestMiddleware], + requestMiddleware: [csrfMiddleware, sentryGlobalRequestMiddleware], functionMiddleware: [sentryGlobalFunctionMiddleware], }; }); From 3a6add6d8f095a08e1eba2012b9d66e34b55dd47 Mon Sep 17 00:00:00 2001 From: Seokju Na Date: Thu, 2 Jul 2026 00:37:07 +0900 Subject: [PATCH 2/2] chore: run Sentry request middleware before CSRF Keep Sentry outermost so it observes the full request, including any CSRF rejection. Addresses cubic review on #9. Co-Authored-By: Claude Opus 4.8 (1M context) Claude-Session: https://claude.ai/code/session_01HhaZ2zL7bAqT3c8mRWTSs9 --- src/start.ts | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/src/start.ts b/src/start.ts index a3d9aff..d51d7ae 100644 --- a/src/start.ts +++ b/src/start.ts @@ -12,7 +12,9 @@ const csrfMiddleware = createCsrfMiddleware({ export const startInstance = createStart(() => { return { - requestMiddleware: [csrfMiddleware, sentryGlobalRequestMiddleware], + // Sentry first (outermost) so it observes the whole request, including any + // CSRF rejection raised by the middleware after it. + requestMiddleware: [sentryGlobalRequestMiddleware, csrfMiddleware], functionMiddleware: [sentryGlobalFunctionMiddleware], }; });