Tools/Notes
1
0
Fork 0
mirror of https://github.com/TriliumNext/Notes.git synced 2025-09-20 02:51:40 +08:00
Code Issues Packages Projects Releases Wiki Activity

Merge pull request #961 from pano9000/fix-csrf-settings

Browse Source 
fix(csrf): set more secure csrf related settings
This commit is contained in:
Elian Doran 2025-01-16 23:03:43 +02:00 committed by GitHub
commit b2e1a3e97a
No known key found for this signature in database
GPG Key ID: B5690EEEBB952194
2 changed files with 3 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
src/routes/csrf_protection.ts
View File

@ -6,8 +6,8 @@ const doubleCsrfUtilities = doubleCsrf({
cookieOptions: { cookieOptions: {
path: "", // empty, so cookie is valid only for the current path path: "", // empty, so cookie is valid only for the current path
secure: false, secure: false,
sameSite: false, sameSite: "strict",
httpOnly: false httpOnly: true
}, },
cookieName: "_csrf" cookieName: "_csrf"
}); });

2
src/routes/index.ts
View File

@ -24,7 +24,7 @@ function index(req: Request, res: Response) {
//'overwrite' set to false (default) => the existing token will be re-used and validated //'overwrite' set to false (default) => the existing token will be re-used and validated
//'validateOnReuse' set to false => if validation fails, generate a new token instead of throwing an error //'validateOnReuse' set to false => if validation fails, generate a new token instead of throwing an error
const csrfToken = generateCsrfToken(req, res, false, false); const csrfToken = generateCsrfToken(req, res, false, false);
log.info(`Generated CSRF token ${csrfToken} with secret ${res.getHeader("set-cookie")}`); log.info(`CSRF token generation: ${csrfToken ? "Successful" : "Failed"}`);
// We force the page to not be cached since on mobile the CSRF token can be // We force the page to not be cached since on mobile the CSRF token can be
// broken when closing the browser and coming back in to the page. // broken when closing the browser and coming back in to the page.