Protocol: freeze device proof and browser CSRF contracts

openapi/control-v1.yaml

@@ -92,6 +92,8 @@ paths:
       operationId: issueReauthenticationGrant
       security:
         - browserSession: []
+          browserCsrfCookie: []
+          browserCsrfHeader: []
       requestBody:
         required: true
         content:
@@ -113,6 +115,8 @@ paths:
       operationId: logoutSession
       security:
         - browserSession: []
+          browserCsrfCookie: []
+          browserCsrfHeader: []
         - nativeBearer: []
       responses:
         '204': {description: Session revoked and browser cookies cleared.}
@@ -123,6 +127,8 @@ paths:
       operationId: registerDevice
       security:
         - browserSession: []
+          browserCsrfCookie: []
+          browserCsrfHeader: []
       requestBody:
         required: true
         content:
@@ -144,6 +150,8 @@ paths:
       operationId: proveDevice
       security:
         - browserSession: []
+          browserCsrfCookie: []
+          browserCsrfHeader: []
       parameters:
         - $ref: '#/components/parameters/DeviceID'
       requestBody:
@@ -167,6 +175,8 @@ paths:
       operationId: revokeDevice
       security:
         - browserSession: []
+          browserCsrfCookie: []
+          browserCsrfHeader: []
       parameters:
         - $ref: '#/components/parameters/DeviceID'
       responses:
@@ -199,6 +209,8 @@ paths:
       description: Control wire version 2 endpoint. Legacy version-1 SessionRequest payloads containing client-supplied policy_snapshot are rejected.
       security:
         - browserSession: []
+          browserCsrfCookie: []
+          browserCsrfHeader: []
         - nativeBearer: []
       parameters:
         - $ref: '#/components/parameters/IdempotencyKey'
@@ -249,6 +261,8 @@ paths:
       operationId: allocateBrokerSession
       security:
         - browserSession: []
+          browserCsrfCookie: []
+          browserCsrfHeader: []
         - nativeBearer: []
       parameters:
         - $ref: '#/components/parameters/SessionID'
@@ -274,6 +288,8 @@ paths:
       operationId: reconnectBrokerSession
       security:
         - browserSession: []
+          browserCsrfCookie: []
+          browserCsrfHeader: []
         - nativeBearer: []
       parameters:
         - $ref: '#/components/parameters/SessionID'
@@ -300,6 +316,8 @@ paths:
       operationId: cancelBrokerSession
       security:
         - browserSession: []
+          browserCsrfCookie: []
+          browserCsrfHeader: []
         - nativeBearer: []
       parameters:
         - $ref: '#/components/parameters/SessionID'
@@ -353,6 +371,16 @@ components:
       type: apiKey
       in: cookie
       name: versevdi_session
+    browserCsrfCookie:
+      type: apiKey
+      in: cookie
+      name: versevdi_csrf
+      description: Must be identical to X-CSRF-Token and is checked against Server session state.
+    browserCsrfHeader:
+      type: apiKey
+      in: header
+      name: X-CSRF-Token
+      description: Must be identical to the versevdi_csrf cookie and is checked against Server session state.
     nativeBearer:
       type: http
       scheme: bearer