gaschz/trilium
1
0
Fork 0
mirror of https://github.com/zadam/trilium.git synced 2025-12-08 00:14:25 +01:00
Code Issues Actions 7 Packages Projects Releases Wiki Activity

fix(server): migrate csrf to v4

Browse Source
This commit is contained in:
Elian Doran 2025-05-15 20:39:31 +03:00
parent 2c1517d259
commit 6f6041ee7b
No known key found for this signature in database
2 changed files with 8 additions and 6 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
apps/server/src/routes/csrf_protection.ts
View File

@ -10,7 +10,8 @@ const doubleCsrfUtilities = doubleCsrf({
sameSite: "strict",
httpOnly: !isElectron // set to false for Electron, see https://github.com/TriliumNext/Notes/pull/966
},
cookieName: "_csrf"
cookieName: "_csrf",
getSessionIdentifier: (req) => req.session.id
});
export const { generateToken, doubleCsrfProtection } = doubleCsrfUtilities;
export const { generateCsrfToken, doubleCsrfProtection } = doubleCsrfUtilities;

9
apps/server/src/routes/index.ts
View File

@ -10,7 +10,7 @@ import protectedSessionService from "../services/protected_session.js";
import packageJson from "../../package.json" with { type: "json" };
import assetPath from "../services/asset_path.js";
import appPath from "../services/app_path.js";
import { generateToken as generateCsrfToken } from "./csrf_protection.js";
import { generateCsrfToken } from "./csrf_protection.js";
import type { Request, Response } from "express";
import type BNote from "../becca/entities/bnote.js";
@ -19,9 +19,10 @@ function index(req: Request, res: Response) {
const options = optionService.getOptionMap();
const view = getView(req);
//'overwrite' set to false (default) => the existing token will be re-used and validated
//'validateOnReuse' set to false => if validation fails, generate a new token instead of throwing an error
const csrfToken = generateCsrfToken(req, res, false, false);
const csrfToken = generateCsrfToken(req, res, {
overwrite: true,
validateOnReuse: false // if validation fails, generate a new token instead of throwing an error
});
log.info(`CSRF token generation: ${csrfToken ? "Successful" : "Failed"}`);
// We force the page to not be cached since on mobile the CSRF token can be