Spaces:
Runtime error
Runtime error
| import Tokens from 'csrf' | |
| import { AppError } from '../lib/AppError.js' | |
| const tokens = new Tokens() | |
| const SAFE_METHODS = ['GET', 'HEAD', 'OPTIONS'] | |
| const CSRF_COOKIE = 'csrf-token' | |
| export function csrfProtection(req, res, next) { | |
| if (SAFE_METHODS.includes(req.method)) return next() | |
| const secret = req.cookies?.[CSRF_COOKIE] | |
| const token = req.headers['x-csrf-token'] || req.body?._csrf | |
| if (!secret || !token) { | |
| return next(new AppError('طلب غير مصرح به (CSRF)', 403, 'CSRF_MISSING')) | |
| } | |
| if (!tokens.verify(secret, token)) { | |
| return next(new AppError('طلب غير مصرح به (CSRF)', 403, 'CSRF_INVALID')) | |
| } | |
| next() | |
| } | |
| export function csrfTokenMiddleware(req, res) { | |
| const existing = req.cookies?.[CSRF_COOKIE] | |
| if (existing && tokens.verify(existing, req.cookies?.[CSRF_COOKIE] || '')) { | |
| return res.json({ csrfToken: tokens.create(existing) }) | |
| } | |
| const secret = tokens.secretSync() | |
| res.cookie(CSRF_COOKIE, secret, { | |
| httpOnly: true, | |
| secure: process.env.NODE_ENV === 'production', | |
| sameSite: process.env.NODE_ENV === 'production' ? 'none' : 'lax', | |
| path: '/', | |
| }) | |
| res.json({ csrfToken: tokens.create(secret) }) | |
| } | |