[devin-ai-integration]

Summary

Fixes code scan finding sfind-4627fb15d87d4057a2e619d80fc350b0 (scan scan-85ec232d98d341f1a872ff09167256d1): SecurityConfig called csrf.disable(), so a page on any other site could submit POST /transfer, /withdraw or /deposit as a logged-in user using only the session cookie.

• SecurityConfig: removed .csrf(csrf -> csrf.disable()), so Spring Security's CsrfFilter runs again. Logout matcher is now new AntPathRequestMatcher("/logout", "POST"). A GET logout link with CSRF on would still let any site log users out.
• Templates: every form now uses th:action="@{/...}" (deposit, withdraw, transfer, login, register), so Thymeleaf adds the hidden _csrf field.
• Logout nav in dashboard.html / transactions.html: the item is still <a class="nav-link" href="/logout">Logout</a>, which the Cypress spec asserts. Its onclick now submits the surrounding #logout-form (POST + _csrf). Without JavaScript, a <noscript> submit button takes the link's place.
• application.properties: server.servlet.session.cookie.same-site=lax and http-only=true as a second layer.
• New BankControllerCsrfTest (@WebMvcTest + SecurityConfig): checks deposit, withdraw and transfer each return 403 without csrf() (and the service is never called) and succeed with it. Also checks that the dashboard renders a _csrf field and that logout is POST-only.

Verification

• ./mvnw test: 10/10 pass (9 new + contextLoads). The Cypress e2e smoke suite passes in CI.
• Live app (MySQL 8, ./mvnw spring-boot:run) tested with curl:
  • Login response sets JSESSIONID=...; HttpOnly; SameSite=Lax.
  • POST /transfer and /withdraw with only the victim's JSESSIONID cookie (plus an Origin: https://evil.example header) return 403, and the balance stays at $1000.00.
  • The same requests with the page's _csrf token return 302 (deposit gives $1000, transfer of 200 gives $800).
  • GET /logout returns 404. A #logout-form POST redirects to /login?logout, and the session is invalidated.

Note: any non-browser client that POSTs to these endpoints now has to send the CSRF token.

Link to Devin session: https://devin-gtm.devinenterprise.com/sessions/bd574ed76fed416596e8c18055a6c3c5
Open in Devin Desktop: https://devin-gtm.devinenterprise.com/desktop/session/bd574ed76fed416596e8c18055a6c3c5?variant=devin

---

Devin Review

Status	Commit
⚪ Not started	—

Run Devin Review

Enable auto-review to review your pull requests automatically.

---

[devin-ai-integration]

I'll fix CI failures and address comments from users with write access. I'll skip comments containing "(aside)".

• Disable automatic comment, CI, and merge conflict monitoring

[devin-ai-integration]

Note

Newer findings are available below. Devin Review posted a newer report on this PR, in addition to the findings presented here.

✅ Devin Review: No Issues Found

Devin Review analyzed this PR and found no bugs or issues to report.