Merge branch 'main' into issue-139

api/src/routes/setupRoutes.ts

@@ -5,7 +5,6 @@ import apiRouter from './api'
 import appStreamRouter from './appStream'
 
 export const setupRoutes = (app: Express) => {
-  app.use('/', webRouter)
   app.use('/SASjsApi', apiRouter)
 
   app.use('/AppStream', function (req, res, next) {
@@ -13,4 +12,6 @@ export const setupRoutes = (app: Express) => {
     // whatever the current router is
     appStreamRouter(req, res, next)
   })
+
+  app.use('/', webRouter)
 }

api/src/routes/web/index.ts

@@ -1,8 +1,9 @@
 import express from 'express'
+import { csrfProtection } from '../../app'
 import webRouter from './web'
 
 const router = express.Router()
 
-router.use('/', webRouter)
+router.use('/', csrfProtection, webRouter)
 
 export default router

api/src/routes/web/web.ts

@@ -14,6 +14,11 @@ webRouter.get('/', async (_, res) => {
   return res.send('Web Build is not present')
 })
 
+webRouter.get('/form', function (req, res) {
+  // pass the csrfToken to the view
+  res.send({ csrfToken: req.csrfToken() })
+})
+
 webRouter.post('/login', async (req, res) => {
   const { error, value: body } = loginWebValidation(req.body)
   if (error) return res.status(400).send(error.details[0].message)