Tools/Notes
1
0
Fork 0
mirror of https://github.com/TriliumNext/Notes.git synced 2025-09-18 17:31:53 +08:00
Code Issues Packages Projects Releases Wiki Activity

fix(csrf): use generateCsrfToken with more "user friendly" settings

Browse Source 
fixes the case, where existing TriliumNext users, will get
a "Invalid CSRF Token" Message, when they have an older
_csrf token in their cookies from a previous installation/visit.
the settings now will handle these cases in the background automatically.

also fixes #950
This commit is contained in:
Panagiotis Papadopoulos 2025-01-16 20:13:04 +01:00
parent 6dd8ab31d5
commit 139bf3dcdf
1 changed files with 5 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
src/routes/index.ts
View File

@ -11,6 +11,8 @@ import protectedSessionService from "../services/protected_session.js";
import packageJson from "../../package.json" with { type: "json" };
import assetPath from "../services/asset_path.js";
import appPath from "../services/app_path.js";
import { generateToken as generateCsrfToken } from "./csrf_protection.js";
import type { Request, Response } from "express";
import type BNote from "../becca/entities/bnote.js";
@ -19,7 +21,9 @@ function index(req: Request, res: Response) {
const view = !utils.isElectron() && req.cookies["trilium-device"] === "mobile" ? "mobile" : "desktop";
const csrfToken = (typeof req.csrfToken === "function") ? req.csrfToken() : undefined;
//'overwrite' set to false (default) => the existing token will be re-used and validated
//'validateOnReuse' set to false => if validation fails, generate a new token instead of throwing an error
const csrfToken = generateCsrfToken(req, res, false, false);
log.info(`Generated CSRF token ${csrfToken} with secret ${res.getHeader("set-cookie")}`);
// We force the page to not be cached since on mobile the CSRF token can be