From ec19ccd7a7287fbefdec306aae3266e79150b5c8 Mon Sep 17 00:00:00 2001 From: Panagiotis Papadopoulos Date: Thu, 16 Jan 2025 21:16:33 +0100 Subject: [PATCH 1/2] fix(csrf): stop leaking the CSRF token in the server logs As per OWASP: "A CSRF token must not be leaked in the server logs or in the URL.", see: https://cheatsheetseries.owasp.org/cheatsheets/Cross-Site_Request_Forgery_Prevention_Cheat_Sheet.html#transmissing-csrf-tokens-in-synchronized-patterns --- src/routes/index.ts | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/routes/index.ts b/src/routes/index.ts index 18cbaf081..5996eddf0 100644 --- a/src/routes/index.ts +++ b/src/routes/index.ts @@ -24,7 +24,7 @@ function index(req: Request, res: Response) { //'overwrite' set to false (default) => the existing token will be re-used and validated //'validateOnReuse' set to false => if validation fails, generate a new token instead of throwing an error const csrfToken = generateCsrfToken(req, res, false, false); - log.info(`Generated CSRF token ${csrfToken} with secret ${res.getHeader("set-cookie")}`); + log.info(`CSRF token generation: ${csrfToken ? "Successful" : "Failed"}`); // We force the page to not be cached since on mobile the CSRF token can be // broken when closing the browser and coming back in to the page. From 5f605b3a9167c612184839cdde3a6c7606be2026 Mon Sep 17 00:00:00 2001 From: Panagiotis Papadopoulos Date: Thu, 16 Jan 2025 21:35:50 +0100 Subject: [PATCH 2/2] fix(csrf): set more secure cookieOptions settings - `sameSite` - previous setting inherited from csurf was to simply not set it at all, which makes all browser nag in their dev console output. They will default to "Lax" for these type of cookies in the future. We can even use "strict" here though for our use case: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Set-Cookie#samesitesamesite-value - `httpOnly`: should be enabled for the csrf cookie as well for the session cookie it already is enabled. https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Set-Cookie#httponly --- src/routes/csrf_protection.ts | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/src/routes/csrf_protection.ts b/src/routes/csrf_protection.ts index aadd02100..0c7968af8 100644 --- a/src/routes/csrf_protection.ts +++ b/src/routes/csrf_protection.ts @@ -6,8 +6,8 @@ const doubleCsrfUtilities = doubleCsrf({ cookieOptions: { path: "", // empty, so cookie is valid only for the current path secure: false, - sameSite: false, - httpOnly: false + sameSite: "strict", + httpOnly: true }, cookieName: "_csrf" });