diff --git a/api/src/app.ts b/api/src/app.ts
index cab4690..a2bfdf9 100644
--- a/api/src/app.ts
+++ b/api/src/app.ts
@@ -1,6 +1,6 @@
import path from 'path'
import express, { ErrorRequestHandler } from 'express'
-import csrf from 'csurf'
+import csrf, { CookieOptions } from 'csurf'
import cookieParser from 'cookie-parser'
import dotenv from 'dotenv'
@@ -32,9 +32,10 @@ const app = express()
const { PROTOCOL } = process.env
-export const cookieOptions = {
+export const cookieOptions: CookieOptions = {
secure: PROTOCOL === ProtocolType.HTTPS,
httpOnly: true,
+ sameSite: PROTOCOL === ProtocolType.HTTPS ? 'none' : undefined,
maxAge: 24 * 60 * 60 * 1000 // 24 hours
}
diff --git a/api/src/routes/api/spec/web.spec.ts b/api/src/routes/api/spec/web.spec.ts
index 45b07f1..12bc4db 100644
--- a/api/src/routes/api/spec/web.spec.ts
+++ b/api/src/routes/api/spec/web.spec.ts
@@ -39,12 +39,11 @@ describe('web', () => {
describe('home', () => {
it('should respond with CSRF Token', async () => {
- await request(app)
- .get('/')
- .expect(
- 'set-cookie',
- /_csrf=.*; Max-Age=86400000; Path=\/; HttpOnly,XSRF-TOKEN=.*; Path=\//
- )
+ const res = await request(app).get('/').expect(200)
+
+ expect(res.text).toMatch(
+ /`
+ const injectedContent = response?.replace(
+ '',
+ `${codeToInject}`
+ )
- return res.send(response)
+ return res.send(injectedContent)
}
})
diff --git a/api/src/utils/verifyEnvVariables.ts b/api/src/utils/verifyEnvVariables.ts
index 84aa607..b0a40b2 100644
--- a/api/src/utils/verifyEnvVariables.ts
+++ b/api/src/utils/verifyEnvVariables.ts
@@ -125,8 +125,27 @@ const verifyCORS = (): string[] => {
if (CORS) {
const corsTypes = Object.values(CorsType)
+
if (!corsTypes.includes(CORS as CorsType))
errors.push(`- CORS '${CORS}'\n - valid options ${corsTypes}`)
+
+ if (CORS === CorsType.ENABLED) {
+ const { WHITELIST } = process.env
+
+ const urls = WHITELIST?.trim()
+ .split(' ')
+ .filter((url) => !!url)
+ if (urls?.length) {
+ urls.forEach((url) => {
+ if (!url.startsWith('http://') && !url.startsWith('https://'))
+ errors.push(
+ `- CORS '${CORS}'\n - provided WHITELIST ${url} is not valid`
+ )
+ })
+ } else {
+ errors.push(`- CORS '${CORS}'\n - provide at least one WHITELIST URL`)
+ }
+ }
} else {
const { MODE } = process.env
process.env.CORS =
diff --git a/web/src/App.tsx b/web/src/App.tsx
index 39c11cf..e0a7d3e 100644
--- a/web/src/App.tsx
+++ b/web/src/App.tsx
@@ -22,7 +22,7 @@ function App() {
- } />
+ } />
diff --git a/web/src/context/appContext.tsx b/web/src/context/appContext.tsx
index 4802a57..dee793e 100644
--- a/web/src/context/appContext.tsx
+++ b/web/src/context/appContext.tsx
@@ -80,7 +80,18 @@ const AppContextProvider = (props: { children: ReactNode }) => {
})
.catch(() => {
setLoggedIn(false)
- axios.get('/') // get CSRF TOKEN
+ // get CSRF TOKEN and set cookie
+ axios
+ .get('/')
+ .then((res) => res.data)
+ .then((data: string) => {
+ const result =
+ /