fix(csrf): resolve all 124 SonarQube CSRF security hotspots

server/routes/account_management.py

@@ -1,7 +1,6 @@
 """Account management routes for connected accounts."""
 import logging
 from flask import Blueprint, request, jsonify
-from utils.web.cors_utils import create_cors_response
 from utils.auth.rbac_decorators import require_auth_only
 from utils.db.db_utils import connect_to_db_as_admin, connect_to_db_as_user
 from utils.auth.token_management import get_token_data
@@ -34,11 +33,6 @@ def _validate_provider_connection(provider: str, token_data: dict) -> bool:
         return False
 
 
-@account_management_bp.route("/api/connected-accounts/<target_user_id>", methods=["OPTIONS"])
-def get_connected_accounts_options(target_user_id):
-    return create_cors_response()
-
-
 @account_management_bp.route("/api/connected-accounts/<target_user_id>", methods=["GET"])
 @require_auth_only
 def get_connected_accounts(user_id, target_user_id):
@@ -212,11 +206,6 @@ def _resolve_row(row):
             conn.close()
 
 
-@account_management_bp.route("/api/connected-accounts/<target_user_id>/<provider>", methods=["OPTIONS"])
-def delete_connected_account_options(target_user_id, provider):
-    return create_cors_response()
-
-
 @account_management_bp.route("/api/connected-accounts/<target_user_id>/<provider>", methods=["DELETE"])
 @require_auth_only
 def delete_connected_account(user_id, target_user_id, provider):
@@ -355,11 +344,6 @@ def delete_connected_account(user_id, target_user_id, provider):
         return jsonify({"error": "Failed to delete connected account"}), 500
 
 
-@account_management_bp.route("/api/getUserId", methods=["OPTIONS"])
-def get_user_id_options():
-    return create_cors_response()
-
-
 @account_management_bp.route("/api/getUserId", methods=["GET"])
 @require_auth_only
 def get_user_id(user_id):
@@ -372,11 +356,6 @@ def get_user_id(user_id):
         return jsonify({"error": "Failed to get user ID"}), 500
 
 
-@account_management_bp.route("/user_tokens", methods=["OPTIONS"])
-def get_user_tokens_options():
-    return create_cors_response()
-
-
 @account_management_bp.route("/user_tokens", methods=["GET"])
 @require_auth_only
 def get_user_tokens(user_id):

server/routes/atlassian/atlassian_routes.py

@@ -117,7 +117,7 @@ def _validate_jsm_ops(access_token: str, cloud_id: str) -> Optional[Dict[str, An
 # POST /atlassian/connect
 # ------------------------------------------------------------------
 
-@atlassian_bp.route("/connect", methods=["POST", "OPTIONS"])
+@atlassian_bp.route("/connect", methods=["POST"])
 @require_permission("connectors", "write")
 def connect(user_id):
     """Unified connect for Atlassian products (Confluence/Jira/both)."""
@@ -288,7 +288,7 @@ def connect(user_id):
 # GET /atlassian/status
 # ------------------------------------------------------------------
 
-@atlassian_bp.route("/status", methods=["GET", "OPTIONS"])
+@atlassian_bp.route("/status", methods=["GET"])
 @require_permission("connectors", "read")
 def status(user_id):
     """Return connection status for all Atlassian products."""
@@ -363,7 +363,7 @@ def status(user_id):
 # POST /atlassian/disconnect
 # ------------------------------------------------------------------
 
-@atlassian_bp.route("/disconnect", methods=["POST", "OPTIONS"])
+@atlassian_bp.route("/disconnect", methods=["POST"])
 @require_permission("connectors", "write")
 def disconnect(user_id):
     """Disconnect one or all Atlassian products."""

server/routes/auth_routes.py

@@ -10,7 +10,6 @@
 from utils.db.db_utils import connect_to_db_as_user
 from utils.db.connection_pool import db_pool
 from utils.auth.rbac_decorators import require_auth_only
-from utils.web.cors_utils import create_cors_response
 import os
 
 auth_bp = Blueprint('auth', __name__, url_prefix='/api/auth')
@@ -35,11 +34,11 @@ def add_cors_headers(response):
     origin = request.headers.get('Origin', FRONTEND_URL)
     response.headers['Access-Control-Allow-Origin'] = origin
     response.headers['Access-Control-Allow-Credentials'] = 'true'
-    response.headers['Access-Control-Allow-Methods'] = 'GET, POST, PUT, DELETE, OPTIONS'
+    response.headers['Access-Control-Allow-Methods'] = 'GET, POST, OPTIONS'
     response.headers['Access-Control-Allow-Headers'] = 'Content-Type, X-Provider, X-Requested-With, X-User-ID, Authorization'
     return response
 
-@auth_bp.route('/register', methods=['POST', 'OPTIONS'])
+@auth_bp.route('/register', methods=['POST'])
 def register():
     """Register a new organization with its first admin user.
 
@@ -48,9 +47,6 @@ def register():
     - Users within an existing org are created by an admin via
       /api/admin/users (invite-only).
     """
-    if request.method == 'OPTIONS':
-        return create_cors_response()
-
     try:
         data = request.get_json()
         if not data:
@@ -162,15 +158,13 @@ def register():
         return jsonify({"error": "Registration failed"}), 500
 
 
-@auth_bp.route('/setup-org', methods=['POST', 'OPTIONS'])
+@auth_bp.route('/setup-org', methods=['POST'])
 @require_auth_only
 def setup_org(user_id):
     """Create an organization for an authenticated user who doesn't have one.
 
     Body: { org_name }
     """
-    if request.method == 'OPTIONS':
-        return create_cors_response()
     try:
         data = request.get_json()
         if not data:
@@ -273,12 +267,9 @@ def setup_org(user_id):
         return jsonify({"error": "Organization setup failed"}), 500
 
 
-@auth_bp.route('/login', methods=['POST', 'OPTIONS'])
+@auth_bp.route('/login', methods=['POST'])
 def login():
     """Authenticate user with email and password."""
-    if request.method == 'OPTIONS':
-        return create_cors_response()
-
     try:
         data = request.get_json()
         if not data:
@@ -339,12 +330,10 @@ def login():
         return jsonify({"error": "Login failed"}), 500
 
 
-@auth_bp.route('/change-password', methods=['POST', 'OPTIONS'])
+@auth_bp.route('/change-password', methods=['POST'])
 @require_auth_only
 def change_password(user_id):
     """Change user password (requires authentication)."""
-    if request.method == 'OPTIONS':
-        return create_cors_response()
     try:
         data = request.get_json()
         if not data:

server/routes/aws/auth.py

@@ -6,7 +6,6 @@
 import flask
 import boto3
 from botocore.exceptions import ClientError
-from utils.web.cors_utils import create_cors_response
 from utils.auth.rbac_decorators import require_permission
 from utils.auth.stateless_auth import get_org_id_from_request
 from utils.logging.secure_logging import mask_credential_value
@@ -18,7 +17,7 @@
 
 auth_bp = Blueprint("aws_auth_bp", __name__)
 
-@auth_bp.route('/get-credentials', methods=['POST', 'OPTIONS'])
+@auth_bp.route('/get-credentials', methods=['POST'])
 @require_permission("connectors", "read")
 def aws_get_credentials(user_id):
     """Retrieve AWS credentials stored for the user."""
@@ -77,21 +76,18 @@ def aws_get_credentials(user_id):
         return jsonify({"error": "Failed to retrieve AWS credentials"}), 500
 
 
-@auth_bp.route('/auth', methods=['POST', 'OPTIONS'])
+@auth_bp.route('/auth', methods=['POST'])
 @require_permission("connectors", "write")
 def auth(user_id):
     """
     AWS authentication endpoint using IAM role assumption.
-    
+
     Requires External ID that matches the workspace's External ID for security.
     Legacy flow without External ID is no longer supported.
     """
-    if flask.request.method == 'OPTIONS':
-        return create_cors_response()
-
     logging.info("=== AWS AUTH ENDPOINT STARTED ===")
     try:
-        data = flask.request.get_json()
+        data = flask.request.get_json(silent=True) or {}
         role_arn = data.get('role_arn')
         read_only_role_arn = data.get('read_only_role_arn') or data.get('readOnlyRoleArn')
         external_id = data.get('external_id')

server/routes/aws/aws_routes.py

@@ -4,24 +4,19 @@
 import logging
 from flask import Blueprint, jsonify
 import flask
-from utils.web.cors_utils import create_cors_response
 import os
 
 aws_bp = Blueprint("aws_bp", __name__)
 
-@aws_bp.route("/setup-script", methods=["GET", "OPTIONS"])
+@aws_bp.route("/setup-script", methods=["GET"])
 def aws_setup_script():
     """Legacy endpoint - redirects to role-based setup"""
-    if flask.request.method == 'OPTIONS':
-        return create_cors_response()
     # Redirect to new role-based script
     return flask.redirect("/aws/setup-role", code=301)
 
-@aws_bp.route("/aws/setup-role", methods=["GET", "OPTIONS"])
+@aws_bp.route("/aws/setup-role", methods=["GET"])
 def aws_setup_role_script():
     """Serve the new role-based setup script"""
-    if flask.request.method == 'OPTIONS':
-        return create_cors_response()
     try:
         script_path = os.path.join(os.path.dirname(__file__), "..", "..", "connectors", "aws_connector", "setup-aurora-role.sh")
         if os.path.exists(script_path):
@@ -36,19 +31,15 @@ def aws_setup_role_script():
         return jsonify({"error": "Failed to serve setup script"}), 500
 
 
-@aws_bp.route("/setup-script-ps1", methods=["GET", "OPTIONS"])
+@aws_bp.route("/setup-script-ps1", methods=["GET"])
 def aws_setup_script_ps1():
     """Legacy endpoint - redirects to role-based setup"""
-    if flask.request.method == 'OPTIONS':
-        return create_cors_response()
     # Redirect to new role-based script
     return flask.redirect("/aws/setup-role-ps1", code=301)
 
-@aws_bp.route("/aws/setup-role-ps1", methods=["GET", "OPTIONS"])
+@aws_bp.route("/aws/setup-role-ps1", methods=["GET"])
 def aws_setup_role_script_ps1():
     """Serve the new role-based PowerShell setup script"""
-    if flask.request.method == 'OPTIONS':
-        return create_cors_response()
     try:
         script_path = os.path.join(os.path.dirname(__file__), "..", "..", "connectors", "aws_connector", "setup-aurora-role.ps1")
         if os.path.exists(script_path):