refactor(server): scope skew-protection exemption to login form

[mscolnick]

Only the server-rendered login form legitimately posts without the
server token, so exempt it by path instead of by Content-Type. Adds
tests covering the login exemption and token enforcement for
form-encoded requests.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
marimo-docs	Ready	Preview, Comment	Jul 15, 2026 3:39pm

[Copilot]

Pull request overview

This PR narrows the SkewProtectionMiddleware exemption so that only the server-rendered login form POST (/auth/login) is allowed to submit without the Marimo-Server-Token header, rather than exempting all application/x-www-form-urlencoded requests. It also adds tests to ensure skew protection is enforced for form-encoded requests while still allowing the login form to function.

Changes:

• Refactor skew-protection exemption logic to key off the /auth/login path instead of Content-Type.
• Add test coverage confirming form-urlencoded requests still require a valid skew token.
• Add a test confirming /auth/login POST is not gated by skew protection.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 4 comments.

File	Description
marimo/_server/api/middleware.py	Replaces the Content-Type-based exemption with a path-based exemption for /auth/login.
tests/_server/api/test_middleware.py	Adds tests covering skew token enforcement for form content types and exemption for the login form POST.

[cubic-dev-ai]

No issues found across 2 files

Architecture diagram

sequenceDiagram
    participant Client as HTTP Client
    participant Middleware as SkewProtectionMiddleware
    participant App as Application

    Note over Client,App: POST requests to server

    Client->>Middleware: POST /auth/login (no skew token)
    Middleware->>Middleware: Check request method (POST)
    Middleware->>Middleware: Path ends with "/auth/login"? → Yes
    Middleware->>App: Pass through (exempted)
    App-->>Client: Login page response

    Client->>Middleware: POST /api/other (form‑encoded, no valid token)
    Middleware->>Middleware: Check request method (POST)
    Middleware->>Middleware: Path is exempt? → No
    Middleware->>Middleware: Path is /api/kernel/execute? → No
    Middleware->>Middleware: Validate skew token header
    alt Valid token present
        Middleware->>App: Pass through
        App-->>Client: Normal response
    else Token invalid or missing
        Middleware-->>Client: 401 Unauthorized
    end

Loading

_{Re-trigger cubic}