CSRF protection for cookie-based refresh #2075
Description
Overview
User Story:
As a system, I want to prevent CSRF attacks on endpoints that rely on cookies.
Action Items
Acceptance Criteria:
- Refresh/logout endpoints are protected by:
- SameSite cookie settings and/or
- CSRF token (double submit or header-based)
- Backend rejects refresh requests missing CSRF proof (if implemented).
Resources/Instructions
- This issue is part of the epic: EPIC: Authentication & Session Management (JWT + Refresh) #2065