sasjs/server
1
0
Fork 0
mirror of https://github.com/sasjs/server.git synced 2025-12-11 19:44:35 +00:00
Code Issues Projects Releases Wiki Activity

fix(cookie): XSRF cookie is removed and passed token in head section

Browse Source
This commit is contained in:
Saad Jutt
2022-08-03 03:38:11 +05:00
parent 78bea7c154
commit 77f8d30baf
3 changed files with 22 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files

5
api/src/app.ts
View File

@@ -1,6 +1,6 @@
import path from 'path' import path from 'path'
import express, { ErrorRequestHandler } from 'express' import express, { ErrorRequestHandler } from 'express'
import csrf from 'csurf' import csrf, { CookieOptions } from 'csurf'
import cookieParser from 'cookie-parser' import cookieParser from 'cookie-parser'
import dotenv from 'dotenv' import dotenv from 'dotenv'
@@ -32,9 +32,10 @@ const app = express()
const { PROTOCOL } = process.env const { PROTOCOL } = process.env
export const cookieOptions = { export const cookieOptions: CookieOptions = {
secure: PROTOCOL === ProtocolType.HTTPS, secure: PROTOCOL === ProtocolType.HTTPS,
httpOnly: true, httpOnly: true,
sameSite: PROTOCOL === ProtocolType.HTTPS ? 'none' : undefined,
maxAge: 24 * 60 * 60 * 1000 // 24 hours maxAge: 24 * 60 * 60 * 1000 // 24 hours
} }

10
api/src/routes/web/web.ts
View File

@@ -11,11 +11,15 @@ webRouter.get('/', async (req, res) => {
try { try {
response = await controller.home() response = await controller.home()
} catch (_) { } catch (_) {
response = 'Web Build is not present' response = '<html><head></head><body>Web Build is not present</body></html>'
} finally { } finally {
res.cookie('XSRF-TOKEN', req.csrfToken()) const codeToInject = `<script>document.cookie = 'XSRF-TOKEN=${req.csrfToken()}; Max-Age=86400; SameSite=Strict; Path=/;'</script>`
const injectedContent = response?.replace(
'</head>',
`${codeToInject}</head>`
)
return res.send(response) return res.send(injectedContent)
} }
}) })

13
web/src/context/appContext.tsx
View File

@@ -80,7 +80,18 @@ const AppContextProvider = (props: { children: ReactNode }) => {
}) })
.catch(() => { .catch(() => {
setLoggedIn(false) setLoggedIn(false)
axios.get('/') // get CSRF TOKEN // get CSRF TOKEN and set cookie
axios
.get('/')
.then((res) => res.data)
.then((data: string) => {
const result =
/<script>document.cookie = '(XSRF-TOKEN=[A-Za-z-0-9; =/]*)'<\/script>/.exec(
data
)?.[1]
if (result) document.cookie = result
})
}) })
axios axios