opencode
bcae59626f
Build & Push Docker Image / build (push) Successful in 2m16s
- Synchronizer token stored in session; GET /auth/csrf to obtain it - csrfProtection middleware requires X-CSRF-Token on non-safe methods - customFetch injects the header via setCsrfTokenGetter - toolrate boot loads token; reload after local login (session regenerate) - OpenAPI GET /auth/csrf + CsrfToken schema, orval regenerated
25 lines
779 B
TypeScript
25 lines
779 B
TypeScript
import crypto from "node:crypto";
|
|
import type { Request, Response, NextFunction } from "express";
|
|
|
|
const SAFE_METHODS = new Set(["GET", "HEAD", "OPTIONS", "TRACE"]);
|
|
|
|
export function getCsrfToken(req: Request): string {
|
|
if (!req.session.csrfToken) {
|
|
req.session.csrfToken = crypto.randomBytes(24).toString("hex");
|
|
}
|
|
return req.session.csrfToken;
|
|
}
|
|
|
|
export function csrfProtection(req: Request, res: Response, next: NextFunction): void {
|
|
if (SAFE_METHODS.has(req.method.toUpperCase())) {
|
|
next();
|
|
return;
|
|
}
|
|
const provided = req.headers["x-csrf-token"];
|
|
const token = getCsrfToken(req);
|
|
if (typeof provided === "string" && provided && provided === token) {
|
|
next();
|
|
return;
|
|
}
|
|
res.status(403).json({ error: "CSRF token missing or invalid" });
|
|
} |