From 77f8d30baf9b1077279c29f1c3e5ca02a5436bc0 Mon Sep 17 00:00:00 2001 From: Saad Jutt Date: Wed, 3 Aug 2022 03:38:11 +0500 Subject: [PATCH 1/5] fix(cookie): XSRF cookie is removed and passed token in head section --- api/src/app.ts | 5 +++-- api/src/routes/web/web.ts | 10 +++++++--- web/src/context/appContext.tsx | 13 ++++++++++++- 3 files changed, 22 insertions(+), 6 deletions(-) diff --git a/api/src/app.ts b/api/src/app.ts index cab4690..a2bfdf9 100644 --- a/api/src/app.ts +++ b/api/src/app.ts @@ -1,6 +1,6 @@ import path from 'path' import express, { ErrorRequestHandler } from 'express' -import csrf from 'csurf' +import csrf, { CookieOptions } from 'csurf' import cookieParser from 'cookie-parser' import dotenv from 'dotenv' @@ -32,9 +32,10 @@ const app = express() const { PROTOCOL } = process.env -export const cookieOptions = { +export const cookieOptions: CookieOptions = { secure: PROTOCOL === ProtocolType.HTTPS, httpOnly: true, + sameSite: PROTOCOL === ProtocolType.HTTPS ? 'none' : undefined, maxAge: 24 * 60 * 60 * 1000 // 24 hours } diff --git a/api/src/routes/web/web.ts b/api/src/routes/web/web.ts index 0cd9283..03510b5 100644 --- a/api/src/routes/web/web.ts +++ b/api/src/routes/web/web.ts @@ -11,11 +11,15 @@ webRouter.get('/', async (req, res) => { try { response = await controller.home() } catch (_) { - response = 'Web Build is not present' + response = 'Web Build is not present' } finally { - res.cookie('XSRF-TOKEN', req.csrfToken()) + const codeToInject = `` + const injectedContent = response?.replace( + '', + `${codeToInject}` + ) - return res.send(response) + return res.send(injectedContent) } }) diff --git a/web/src/context/appContext.tsx b/web/src/context/appContext.tsx index 4802a57..258c9ef 100644 --- a/web/src/context/appContext.tsx +++ b/web/src/context/appContext.tsx @@ -80,7 +80,18 @@ const AppContextProvider = (props: { children: ReactNode }) => { }) .catch(() => { setLoggedIn(false) - axios.get('/') // get CSRF TOKEN + // get CSRF TOKEN and set cookie + axios + .get('/') + .then((res) => res.data) + .then((data: string) => { + const result = + /