mirror of https://github.com/calzoneman/sync.git
41 lines
872 B
JavaScript
41 lines
872 B
JavaScript
|
/*
|
||
|
|
* Adapted from https://github.com/expressjs/csurf
|
||
|
|
*/
|
||
|
|
|
||
|
|
var csrf = require("csrf");
|
||
|
|
var createError = require("http-errors");
|
||
|
|
|
||
|
|
var tokens = csrf();
|
||
|
|
|
||
|
|
exports.init = function csrfInit(req, res, next) {
|
||
|
|
var secret = req.signedCookies._csrf;
|
||
|
|
if (!secret) {
|
||
|
|
secret = tokens.secretSync();
|
||
|
|
res.cookie("_csrf", secret, { signed: true, httpOnly: true });
|
||
|
|
}
|
||
|
|
|
||
|
|
var token;
|
||
|
|
|
||
|
|
req.csrfToken = function csrfToken() {
|
||
|
|
if (token) {
|
||
|
|
return token;
|
||
|
|
}
|
||
|
|
|
||
|
|
token = tokens.create(secret);
|
||
|
|
return token;
|
||
|
|
};
|
||
|
|
|
||
|
|
next();
|
||
|
|
};
|
||
|
|
|
||
|
|
exports.verify = function csrfVerify(req) {
|
||
|
|
var secret = req.signedCookies._csrf;
|
||
|
|
var token = req.body._csrf || req.query._csrf;
|
||
|
|
|
||
|
|
if (!tokens.verify(secret, token)) {
|
||
|
|
throw createError(403, 'invalid csrf token', {
|
||
|
|
code: 'EBADCSRFTOKEN'
|
||
|
|
});
|
||
|
|
}
|
||
|
|
};
|