Tools/Notes
1
0
Fork 0
mirror of https://github.com/TriliumNext/Notes.git synced 2025-08-10 02:02:29 +08:00
Code Issues Packages Projects Releases Wiki Activity

refactor(csrf): move csrf to own file

Browse Source
This commit is contained in:
Panagiotis Papadopoulos 2025-01-16 08:25:02 +01:00
parent edc6b983ac
commit e3d89ce2a5
2 changed files with 17 additions and 12 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

15
src/routes/csrf_protection.ts Normal file
View File

@ -0,0 +1,15 @@
import { doubleCsrf } from "csrf-csrf";
import sessionSecret from "../services/session_secret.js";
const doubleCsrfUtilities = doubleCsrf({
getSecret: () => sessionSecret,
cookieOptions: {
path: "", // empty, so cookie is valid only for the current path
secure: false,
sameSite: false,
httpOnly: false
},
cookieName: "_csrf"
});
export const { doubleCsrfProtection } = doubleCsrfUtilities;

14
src/routes/routes.ts
View File

@ -9,13 +9,12 @@ import auth from "../services/auth.js";
import cls from "../services/cls.js";
import sql from "../services/sql.js";
import entityChangesService from "../services/entity_changes.js";
import { doubleCsrf } from "csrf-csrf";
import { doubleCsrfProtection as csrfMiddleware } from "./csrf_protection.js";
import { createPartialContentHandler } from "@triliumnext/express-partial-content";
import rateLimit from "express-rate-limit";
import AbstractBeccaEntity from "../becca/entities/abstract_becca_entity.js";
import NotFoundError from "../errors/not_found_error.js";
import ValidationError from "../errors/validation_error.js";
import sessionSecret from "../services/session_secret.js";
// page routes
import setupRoute from "./setup.js";
@ -72,16 +71,7 @@ import etapiSpecialNoteRoutes from "../etapi/special_notes.js";
import etapiSpecRoute from "../etapi/spec.js";
import etapiBackupRoute from "../etapi/backup.js";
const { doubleCsrfProtection: csrfMiddleware } = doubleCsrf({
getSecret: () => sessionSecret,
cookieOptions: {
path: "", // empty, so cookie is valid only for the current path
secure: false,
sameSite: false,
httpOnly: false
},
cookieName: "_csrf"
});
const MAX_ALLOWED_FILE_SIZE_MB = 250;
const GET = "get",