fix(identity): PASS popup CSRF 검사 제외 #0

[kusuri12-09]

Summary

• 비로그인 공개 API인 PASS popup 요청이 CSRF 검증에서 403으로 차단되는 문제를 수정합니다.

Related Issue

Root Cause

• permitAll()은 인증만 면제하므로 POST /api/identity/v11/auth/pass/popup에도 CSRF 검사가 적용됐습니다.
• API와 프론트엔드가 서로 다른 서브도메인을 사용해 API의 host-only CSRF 쿠키 값을 프론트엔드가 헤더로 전달할 수 없었습니다.

Fix Description

• PASS_POPUP 경로만 CSRF 검사에서 제외했습니다.
• 로그인 등 다른 공개 상태 변경 API의 CSRF 정책은 유지했습니다.

Testing

• Reproduced before fix
• Verified after fix
• Test details: bazel test //systems/identity/identity-bootstrap:test --test_output=errors

Risk & Impact

• Risk level: Low
• Affected areas: PASS 본인인증 팝업 시작 API

Checklist

• No new regressions introduced
• Edge cases considered
• Logs / error handling updated if needed (해당 없음)

[coderabbitai]

Important

Review skipped

Auto reviews are limited based on label configuration.

🏷️ Required labels (at least one) (1)

• ready-for-review

🚫 Excluded labels (none allowed) (2)

• wip
• do-not-review

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: ASSERTIVE

Plan: Advanced

Run ID: ed680336-537e-46df-98f1-194def2aba39

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}