gaschz/trilium
1
0
Fork 0
mirror of https://github.com/zadam/trilium.git synced 2026-03-21 15:53:37 +01:00
Code Issues Actions 16 Packages Projects Releases Wiki Activity

fix(desktop): broken due to CSRF failing

Browse Source
This commit is contained in:
Elian Doran 2026-03-15 18:54:37 +02:00
parent 9290a60b23
commit e36d7121f1
No known key found for this signature in database
1 changed files with 6 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

7
apps/server/src/routes/csrf_protection.ts
View File

@ -1,4 +1,5 @@
import { doubleCsrf } from "csrf-csrf";
import sessionSecret from "../services/session_secret.js";
import { isElectron } from "../services/utils.js";
@ -13,7 +14,11 @@ const doubleCsrfUtilities = doubleCsrf({
httpOnly: !isElectron // set to false for Electron, see https://github.com/TriliumNext/Trilium/pull/966
},
cookieName: CSRF_COOKIE_NAME,
getSessionIdentifier: (req) => req.session.id
// In Electron, API calls go through an IPC bypass (routes/electron.ts) that uses a
// FakeRequest with a static session ID, while the bootstrap request goes through real
// Express with a real session. This mismatch causes CSRF validation to always fail.
// Since Electron is a local single-user app, a constant identifier is acceptable here.
getSessionIdentifier: (req) => isElectron ? "electron" : req.session.id
});
export const { generateCsrfToken, doubleCsrfProtection } = doubleCsrfUtilities;