-
Notifications
You must be signed in to change notification settings - Fork 0
/
index.js
302 lines (244 loc) · 6.04 KB
/
index.js
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
/*!
* csurf
* Copyright(c) 2011 Sencha Inc.
* Copyright(c) 2014 Jonathan Ong
* Copyright(c) 2014-2016 Douglas Christopher Wilson
* MIT Licensed
*/
'use strict'
/**
* Module dependencies.
* @private
*/
var Cookie = require('cookie')
var createError = require('http-errors')
var sign = require('cookie-signature').sign
var Tokens = require('csrf')
/**
* Module exports.
* @public
*/
module.exports = csurf
/**
* CSRF protection middleware.
*
* This middleware adds a `req.csrfToken()` function to make a token
* which should be added to requests which mutate
* state, within a hidden form field, query-string etc. This
* token is validated against the visitor's session.
*
* @param {Object} options
* @return {Function} middleware
* @public
*/
function csurf (options) {
var opts = options || {}
// get cookie options
var cookie = getCookieOptions(opts.cookie)
// get session options
var sessionKey = opts.sessionKey || 'session'
// get value getter
var value = opts.value || defaultValue
// token repo
var tokens = new Tokens(opts)
// ignored methods
var ignoreMethods = opts.ignoreMethods === undefined
? ['GET', 'HEAD', 'OPTIONS']
: opts.ignoreMethods
if (!Array.isArray(ignoreMethods)) {
throw new TypeError('option ignoreMethods must be an array')
}
// generate lookup
var ignoreMethod = getIgnoredMethods(ignoreMethods)
return function csrf (req, res, next) {
//@add opts.ignoreUrls by chengyu
if (opts.ignoreUrls.indexOf(req.url) > -1) {
return next()
}
// validate the configuration against request
if (!verifyConfiguration(req, sessionKey, cookie)) {
return next(new Error('misconfigured csrf'))
}
// get the secret from the request
var secret = getSecret(req, sessionKey, cookie)
var token
// lazy-load token getter
req.csrfToken = function csrfToken () {
var sec = !cookie
? getSecret(req, sessionKey, cookie)
: secret
// use cached token if secret has not changed
if (token && sec === secret) {
return token
}
// generate & set new secret
if (sec === undefined) {
sec = tokens.secretSync()
setSecret(req, res, sessionKey, sec, cookie)
}
// update changed secret
secret = sec
// create new token
token = tokens.create(secret)
return token
}
// generate & set secret
if (!secret) {
secret = tokens.secretSync()
setSecret(req, res, sessionKey, secret, cookie)
}
// verify the incoming token
if (!ignoreMethod[req.method] && !tokens.verify(secret, value(req))) {
return next(createError(403, 'invalid csrf token', {
code: 'EBADCSRFTOKEN'
}))
}
next()
}
}
/**
* Default value function, checking the `req.body`
* and `req.query` for the CSRF token.
*
* @param {IncomingMessage} req
* @return {String}
* @api private
*/
function defaultValue (req) {
return (req.body && req.body._csrf) ||
(req.query && req.query._csrf) ||
(req.headers['csrf-token']) ||
(req.headers['xsrf-token']) ||
(req.headers['x-csrf-token']) ||
(req.headers['x-xsrf-token'])
}
/**
* Get options for cookie.
*
* @param {boolean|object} [options]
* @returns {object}
* @api private
*/
function getCookieOptions (options) {
if (options !== true && typeof options !== 'object') {
return undefined
}
var opts = Object.create(null)
// defaults
opts.key = '_csrf'
opts.path = '/'
if (options && typeof options === 'object') {
for (var prop in options) {
var val = options[prop]
if (val !== undefined) {
opts[prop] = val
}
}
}
return opts
}
/**
* Get a lookup of ignored methods.
*
* @param {array} methods
* @returns {object}
* @api private
*/
function getIgnoredMethods (methods) {
var obj = Object.create(null)
for (var i = 0; i < methods.length; i++) {
var method = methods[i].toUpperCase()
obj[method] = true
}
return obj
}
/**
* Get the token secret from the request.
*
* @param {IncomingMessage} req
* @param {String} sessionKey
* @param {Object} [cookie]
* @api private
*/
function getSecret (req, sessionKey, cookie) {
// get the bag & key
var bag = getSecretBag(req, sessionKey, cookie)
var key = cookie ? cookie.key : 'csrfSecret'
if (!bag) {
throw new Error('misconfigured csrf')
}
// return secret from bag
return bag[key]
}
/**
* Get the token secret bag from the request.
*
* @param {IncomingMessage} req
* @param {String} sessionKey
* @param {Object} [cookie]
* @api private
*/
function getSecretBag (req, sessionKey, cookie) {
if (cookie) {
// get secret from cookie
var cookieKey = cookie.signed
? 'signedCookies'
: 'cookies'
return req[cookieKey]
} else {
// get secret from session
return req[sessionKey]
}
}
/**
* Set a cookie on the HTTP response.
*
* @param {OutgoingMessage} res
* @param {string} name
* @param {string} val
* @param {Object} [options]
* @api private
*/
function setCookie (res, name, val, options) {
var data = Cookie.serialize(name, val, options)
var prev = res.getHeader('set-cookie') || []
var header = Array.isArray(prev) ? prev.concat(data)
: [prev, data]
res.setHeader('set-cookie', header)
}
/**
* Set the token secret on the request.
*
* @param {IncomingMessage} req
* @param {OutgoingMessage} res
* @param {string} sessionKey
* @param {string} val
* @param {Object} [cookie]
* @api private
*/
function setSecret (req, res, sessionKey, val, cookie) {
if (cookie) {
// set secret on cookie
var value = val
if (cookie.signed) {
value = 's:' + sign(val, req.secret)
}
setCookie(res, cookie.key, value, cookie)
} else {
// set secret on session
req[sessionKey].csrfSecret = val
}
}
/**
* Verify the configuration against the request.
* @private
*/
function verifyConfiguration (req, sessionKey, cookie) {
if (!getSecretBag(req, sessionKey, cookie)) {
return false
}
if (cookie && cookie.signed && !req.secret) {
return false
}
return true
}