XAIHT CSRF-exempt audit
The TlamatiniVsOpenClaw report counted 60+ @csrf_exempt decorators in
Tlamatini/agent/views.py. Most are necessary for WebSocket-adjacent
JSON endpoints, but the wholesale exemption is a security smell.
Procedure
- Grep
Tlamatini/agent/views.pyfor@csrf_exempt. - For each match, inspect the view above it and classify:
unsafe-without-csrf: state-changing POST that should NOT be exempt.safe-because-websocket: feeds a WebSocket session-restore path.safe-because-internal-tool: only callable by Tlamatini's own JS; a CSRF token would be appropriate.unknown: needs human review.
- For each non-
safe-because-websocketrow, propose the smallest fix (token tag, middleware exception, view rewrite).
Return { total, classifications: [{view_name, kind}], recommendations: [...] }.