Tools/Notes
1
0
Fork 0
mirror of https://github.com/TriliumNext/Notes.git synced 2025-08-13 04:13:19 +08:00
Code Issues Packages Projects Releases Wiki Activity

refactor: replace csurf with csrf-csrf

Browse Source 
I've kept the identical same settings as before –
however they are not *ideal* from what I read.
More secure settings will need to be tested a bit more thoroughly first and will be a separate PR.
This commit is contained in:
Panagiotis Papadopoulos 2024-12-30 15:31:29 +01:00
parent 5268aaee4f
commit b787610717
1 changed files with 10 additions and 5 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

15
src/routes/routes.ts
View File

@ -9,7 +9,7 @@ import auth from "../services/auth.js";
import cls from "../services/cls.js"; import cls from "../services/cls.js";
import sql from "../services/sql.js"; import sql from "../services/sql.js";
import entityChangesService from "../services/entity_changes.js"; import entityChangesService from "../services/entity_changes.js";
import csurf from "csurf"; import { doubleCsrf } from "csrf-csrf";
import { createPartialContentHandler } from "@triliumnext/express-partial-content"; import { createPartialContentHandler } from "@triliumnext/express-partial-content";
import rateLimit from "express-rate-limit"; import rateLimit from "express-rate-limit";
import AbstractBeccaEntity from "../becca/entities/abstract_becca_entity.js"; import AbstractBeccaEntity from "../becca/entities/abstract_becca_entity.js";
@ -71,10 +71,15 @@ import etapiSpecialNoteRoutes from "../etapi/special_notes.js";
import etapiSpecRoute from "../etapi/spec.js"; import etapiSpecRoute from "../etapi/spec.js";
import etapiBackupRoute from "../etapi/backup.js"; import etapiBackupRoute from "../etapi/backup.js";
const csrfMiddleware = csurf({ const { doubleCsrfProtection: csrfMiddleware } = doubleCsrf({
cookie: { getSecret: (req) => req.secret,
path: "" // empty, so cookie is valid only for the current path cookieOptions: {
} path: "", // empty, so cookie is valid only for the current path
secure: false,
sameSite: false,
httpOnly: false,
},
cookieName: "_csrf",
}); });
const MAX_ALLOWED_FILE_SIZE_MB = 250; const MAX_ALLOWED_FILE_SIZE_MB = 250;