# T03 — The CSRF/auth exemption coupling

**Threat model.** An unauthenticated attacker on the internet requests the
paths that are exempt from CSRF, which `CONTEXT.md` shows are also exempt from
authentication.

**Slice.** `internal/server/server.go` lines 390-420 and 540-570 and 685-690,
`internal/integrations/integration.go`, each integration's declaration
(`stripe.go`, `discourse.go`, `fedwiki.go`), the `/domains/ask` handler, and
`internal/server/route_aware_handler*.go`.

**Questions.**
1. Enumerate every currently exempt path. For each, what authenticates the
   caller instead of a session, and is that check actually reached?
2. Is exemption matched exactly, or by prefix? Can a request shape a path that
   matches the exemption but routes to a different handler (trailing slash,
   encoded characters, path traversal, differing case, duplicate slashes)?
3. `/domains/ask` is unauthenticated by design. What can an arbitrary internet
   caller learn or change through it, and is that the intended blast radius?
4. `routeAware` applies auth only to requests matching a registered pattern.
   What happens to a request that matches no pattern, and can that be used to
   skip middleware?
5. If an integration author adds one path to `CSRFExemptPaths`, what exactly
   have they turned off? Is anything stopping them from exempting a
   session-bearing browser route?

**Not in scope.** The webhook signature checks themselves (T04).