From 19e3b3083054aa56f547dcc55123c952739792a1 Mon Sep 17 00:00:00 2001
From: Paul Schneider <paul@pschneider.fr>
Date: Mon, 6 Jul 2026 00:57:47 +0100
Subject: [PATCH] Potential fix for pull request finding 'CodeQL / Missing
 cross-site request forgery token validation'

Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com>
---
 src/Yavsc.Api/Controllers/Business/BillingController.cs | 1 +
 1 file changed, 1 insertion(+)

diff --git a/src/Yavsc.Api/Controllers/Business/BillingController.cs b/src/Yavsc.Api/Controllers/Business/BillingController.cs
index b26f3bb5..65a6dbcf 100644
--- a/src/Yavsc.Api/Controllers/Business/BillingController.cs
+++ b/src/Yavsc.Api/Controllers/Business/BillingController.cs
@@ -204,6 +204,7 @@ namespace Yavsc.ApiControllers
         /// the URL surface.</para>
         /// </summary>
         [HttpPost("estimate/{id:long}/sign")]
+        [ValidateAntiForgeryToken]
         [Consumes("application/json")]
         [ProducesResponseType(StatusCodes.Status201Created)]
         [ProducesResponseType(StatusCodes.Status400BadRequest)]