ashpie/swaf
1
0
Fork 0
Code Issues 22 Pull Requests Releases 11 Wiki Activity

CsrfTokenComponent: Use a global empty function for SSR

Browse Source
This commit is contained in:
Alice Gaudon 2021-06-02 17:12:24 +02:00
parent 9ac42bb3db
commit 77ff2505b2
2 changed files with 10 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
src/assets/views/utils/CsrfTokenField.svelte
View File

@ -1,7 +1,6 @@
<script lang="ts"> <script lang="ts">
import {locals} from "../../ts/stores.js"; import {locals} from "../../ts/stores.js";
import Field from "./Field.svelte"; import Field from "./Field.svelte";
const token = $locals.getCsrfToken ? $locals.getCsrfToken() : undefined;
</script> </script>
<Field type="hidden" name="csrf" value={token}/> <Field type="hidden" name="csrf" value={$locals.getCsrfToken()}/>

9
src/components/CsrfProtectionComponent.ts
View File

@ -5,6 +5,7 @@ import {Session, SessionData} from "express-session";
import ApplicationComponent from "../ApplicationComponent.js"; import ApplicationComponent from "../ApplicationComponent.js";
import {AuthMiddleware} from "../auth/AuthComponent.js"; import {AuthMiddleware} from "../auth/AuthComponent.js";
import {BadRequestError} from "../HttpError.js"; import {BadRequestError} from "../HttpError.js";
import FrontendToolsComponent from "./FrontendToolsComponent.js";
export default class CsrfProtectionComponent extends ApplicationComponent { export default class CsrfProtectionComponent extends ApplicationComponent {
private static readonly excluders: ((req: Request) => boolean)[] = []; private static readonly excluders: ((req: Request) => boolean)[] = [];
@ -16,6 +17,14 @@ export default class CsrfProtectionComponent extends ApplicationComponent {
return session.csrf; return session.csrf;
} }
public async init(): Promise<void> {
const globals = this.getApp().asOptional(FrontendToolsComponent)?.getGlobals();
if (globals) {
globals.set('getCsrfToken', () => null);
}
}
public static addExcluder(excluder: (req: Request) => boolean): void { public static addExcluder(excluder: (req: Request) => boolean): void {
this.excluders.push(excluder); this.excluders.push(excluder);
} }