gaschz/trilium
1
0
Fork 0
mirror of https://github.com/zadam/trilium.git synced 2026-03-21 07:43:38 +01:00
Code Issues Actions 22 Packages Projects Releases Wiki Activity

chore(server): use random UUID for session ID

Browse Source
This commit is contained in:
Elian Doran 2026-03-15 19:33:06 +02:00
parent 6701d09df5
commit 495145e033
No known key found for this signature in database
1 changed files with 8 additions and 5 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

13
apps/server/src/routes/csrf_protection.ts
View File

@ -1,3 +1,4 @@
import crypto from "crypto";
import { doubleCsrf } from "csrf-csrf";
import sessionSecret from "../services/session_secret.js";
@ -5,6 +6,12 @@ import { isElectron } from "../services/utils.js";
export const CSRF_COOKIE_NAME = "trilium-csrf";
// In Electron, API calls go through an IPC bypass (routes/electron.ts) that uses a
// FakeRequest with a static session ID, while the bootstrap request goes through real
// Express with a real session. This mismatch causes CSRF validation to always fail.
// We use a per-instance random identifier so each Electron process still gets unique tokens.
const electronSessionId = crypto.randomUUID();
const doubleCsrfUtilities = doubleCsrf({
getSecret: () => sessionSecret,
cookieOptions: {
@ -14,11 +21,7 @@ const doubleCsrfUtilities = doubleCsrf({
httpOnly: !isElectron // set to false for Electron, see https://github.com/TriliumNext/Trilium/pull/966
},
cookieName: CSRF_COOKIE_NAME,
// In Electron, API calls go through an IPC bypass (routes/electron.ts) that uses a
// FakeRequest with a static session ID, while the bootstrap request goes through real
// Express with a real session. This mismatch causes CSRF validation to always fail.
// Since Electron is a local single-user app, a constant identifier is acceptable here.
getSessionIdentifier: (req) => isElectron ? "electron" : req.session.id
getSessionIdentifier: (req) => isElectron ? electronSessionId : req.session.id
});
export const { generateCsrfToken, doubleCsrfProtection } = doubleCsrfUtilities;