Skip to content
This repository was archived by the owner on Aug 8, 2023. It is now read-only.

Commit 1e06844

Browse files
author
Ian Walter
committed
Simplifying token generation logic
1 parent 79545f4 commit 1e06844

File tree

4 files changed

+64
-158
lines changed

4 files changed

+64
-158
lines changed

‎index.js‎

Lines changed: 38 additions & 66 deletions
Original file line numberDiff line numberDiff line change
@@ -12,83 +12,55 @@ class InvalidCsrfError extends BaseError {
1212
}
1313
}
1414

15-
class CsrfGeneration {
16-
constructor (options = {}) {
17-
this.print = new Print({ level: options.logLevel || 'info' })
18-
}
19-
20-
middleware (req, res, next) {
21-
let secret = req.session.csrfSecret
22-
let token
23-
24-
req.generateCsrfToken = () => {
25-
// Use the cached token if the secret hasn't changed.
26-
if (token && secret === req.session.csrfSecret) {
27-
return token
28-
}
29-
30-
// Generate a new secret if there isn't one stored in the session.
31-
if (req.session.csrfSecret === undefined) {
32-
req.session.csrfSecret = tokens.secretSync()
33-
}
34-
35-
// Update the cached secret with the secret in the session.
36-
secret = req.session.csrfSecret
37-
38-
// Update the cached token by generating a new one and return it.
39-
token = tokens.create(secret)
40-
41-
// Output the created secret and CSRF token for debugging purposes.
42-
this.print.debug(`Created CSRF secret '${secret}' and token '${token}'`)
43-
44-
return token
45-
}
15+
let print = new Print({ level: 'info' })
4616

47-
// If there is no cached secret, generate a new one and add it to the
48-
// session.
49-
if (!secret) {
50-
secret = tokens.secretSync()
51-
req.session.csrfSecret = secret
17+
const csrfGeneration = (req, res, next) => {
18+
req.generateCsrfToken = () => {
19+
//
20+
if (!req.session.csrfSecret) {
21+
req.session.csrfSecret = tokens.secretSync()
5222
}
5323

54-
// Continue to the next middleware.
55-
next()
56-
}
57-
}
24+
//
25+
const token = tokens.create(req.session.csrfSecret)
5826

59-
const csrfGeneration = new CsrfGeneration()
27+
// Output the created secret and CSRF token for debugging purposes.
28+
const secret = req.session.csrfSecret
29+
print.debug(`Created CSRF secret '${secret}' and token '${token}'`)
6030

61-
class CsrfValidation {
62-
constructor (options = {}) {
63-
this.print = new Print({ level: options.logLevel || 'info' })
31+
//
32+
return token
6433
}
6534

66-
middleware (req, res, next) {
67-
const secret = req.session.csrfSecret
68-
const token = req.headers['csrf-token']
69-
if (ignoredMethods.includes(req.method) || tokens.verify(secret, token)) {
70-
// Continue to the next middleware if the request is using a method that
71-
// isn't vulnerable to a CSRF attack or if the CSRF token contained in the
72-
// header matches the CSRF secret stored in the session.
73-
next()
74-
} else {
75-
// Output the mismatched secret and token for debugging purposes.
76-
this.print.debug(`CSRF secret '${secret}' and token '${token}' mismatch`)
35+
// Continue to the next middleware.
36+
next()
37+
}
7738

78-
// If the CSRF token contained in the request header doesn't match the
79-
// CSRF secret stored in the session, pass the InvalidCsrfError to the
80-
// next error-handling middleware.
81-
next(new InvalidCsrfError(token))
82-
}
39+
const csrfValidation = (req, res, next) => {
40+
const secret = req.session.csrfSecret
41+
const token = req.headers['csrf-token']
42+
if (ignoredMethods.includes(req.method) || tokens.verify(secret, token)) {
43+
// Continue to the next middleware if the request is using a method that
44+
// isn't vulnerable to a CSRF attack or if the CSRF token contained in the
45+
// header matches the CSRF secret stored in the session.
46+
next()
47+
} else {
48+
// Output the mismatched secret and token for debugging purposes.
49+
print.debug(`CSRF secret '${secret}' and token '${token}' mismatch`)
50+
51+
// If the CSRF token contained in the request header doesn't match the
52+
// CSRF secret stored in the session, pass the InvalidCsrfError to the
53+
// next error-handling middleware.
54+
next(new InvalidCsrfError(token))
8355
}
8456
}
8557

86-
const csrfValidation = new CsrfValidation()
58+
function setLogLevel (level) {
59+
print = new Print({ level })
60+
}
8761

8862
module.exports = {
89-
CsrfGeneration,
90-
csrfGeneration: csrfGeneration.middleware.bind(csrfGeneration),
91-
CsrfValidation,
92-
csrfValidation: csrfValidation.middleware.bind(csrfValidation),
93-
InvalidCsrfError
63+
csrfGeneration,
64+
csrfValidation,
65+
setLogLevel
9466
}

‎package.json‎

Lines changed: 2 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -37,11 +37,10 @@
3737
"@ianwalter/eslint-config": "^2.4.0",
3838
"@ianwalter/release": "^3.0.3",
3939
"@ianwalter/renovate-config": "^1.2.0",
40-
"@ianwalter/requester": "^1.2.0",
40+
"@ianwalter/requester": "^1.2.1",
4141
"@ianwalter/test-server": "^2.0.1",
4242
"express": "^4.17.1",
43-
"express-session": "^1.16.2",
44-
"supertest": "^4.0.2"
43+
"express-session": "^1.16.2"
4544
},
4645
"eslintConfig": {
4746
"root": true,

‎tests.js‎

Lines changed: 14 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -2,14 +2,17 @@ const { test } = require('@ianwalter/bff')
22
const { requester } = require('@ianwalter/requester')
33
const { createExpressServer } = require('@ianwalter/test-server')
44
const session = require('express-session')
5-
const { csrfGeneration, csrfValidation } = require('.')
5+
const { csrfGeneration, csrfValidation, setLogLevel } = require('.')
66

77
const sessionMiddleware = session({
88
secret: 'Booksmart Devil',
99
resave: false,
1010
saveUninitialized: false
1111
})
1212

13+
// Set CSRF middleware log level to debug.
14+
setLogLevel('debug')
15+
1316
test(
1417
'GET method is allowed to pass through without a CSRF header'
1518
)(async ({ expect }) => {
@@ -25,7 +28,7 @@ test(
2528
await server.close()
2629
})
2730

28-
test(
31+
test.skip(
2932
'POST method is not allowed to pass through without a CSRF header'
3033
)(async ({ expect }) => {
3134
const server = await createExpressServer()
@@ -39,7 +42,7 @@ test(
3942
await server.close()
4043
})
4144

42-
test.only(
45+
test(
4346
'POST method is allowed to pass through with a valid CSRF header'
4447
)(async ({ expect }) => {
4548
const server = await createExpressServer()
@@ -52,9 +55,13 @@ test.only(
5255
})
5356
server.post('/message', (req, res) => res.status(201).json({ message }))
5457
server.useErrorMiddleware()
55-
const { body: { csrfToken } } = await requester.get(server.url)
56-
const options = { headers: { 'csrf-token': csrfToken }, body: { message } }
57-
const response = await requester.post(`${server.url}/message`, options)
58-
expect(response.status).toBe(201)
58+
let response = await requester.get(server.url)
59+
const headers = {
60+
'csrf-token': response.body.csrfToken,
61+
cookie: response.headers['set-cookie']
62+
}
63+
const options = { headers, body: { message } }
64+
response = await requester.post(`${server.url}/message`, options)
65+
expect(response.statusCode).toBe(201)
5966
expect(response.body.message).toBe(message)
6067
})

‎yarn.lock‎

Lines changed: 10 additions & 82 deletions
Original file line numberDiff line numberDiff line change
@@ -135,10 +135,10 @@
135135
resolved "https://registry.yarnpkg.com/@ianwalter/renovate-config/-/renovate-config-1.2.0.tgz#f84e2fc56ad5d29c0876058c16c25db95baf74a9"
136136
integrity sha512-OSvziSdR0gxnWeH+9KbS9+HjojFa73vqNFU7wAxWs2ZV/9YofpKw0HwGtzyYgb1xVk8g6ZFPMYaTnFZ4Af6N/w==
137137

138-
"@ianwalter/requester@^1.2.0":
139-
version "1.2.0"
140-
resolved "https://registry.yarnpkg.com/@ianwalter/requester/-/requester-1.2.0.tgz#727787667f8106fb0ae9e744bc3883693ec46bbb"
141-
integrity sha512-nru5aOICjrjGGUgAAvMWOVTduA/dViXfyyAjyS1KkgHo+gp2d6mXIrk0fuSq7ZXLqmxJxwAuv9ndmR4OModG9g==
138+
"@ianwalter/requester@^1.2.1":
139+
version "1.2.1"
140+
resolved "https://registry.yarnpkg.com/@ianwalter/requester/-/requester-1.2.1.tgz#61b2de8c6b2296b2f0e797bb52c373e0f6275cf8"
141+
integrity sha512-6atAx+Ee0zUx063tSdml2oOCyjUu7Pv17Pb2Mv7gg8NUg45/5Zl6GYPwj97el8YTZYjpNDCdvblpb/EUPZyiyQ==
142142
dependencies:
143143
"@ianwalter/base-error" "^6.0.0"
144144

@@ -440,11 +440,6 @@ astral-regex@^1.0.0:
440440
resolved "https://registry.yarnpkg.com/astral-regex/-/astral-regex-1.0.0.tgz#6c8c3fb827dd43ee3918f27b82782ab7658a6fd9"
441441
integrity sha512-+Ryf6g3BKoRc7jfp7ad8tM4TtMiaWvbF/1/sQcZPkkS7ag3D5nMBCe2UfOTONtAkaG0tO0ij3C5Lwmf1EiyjHg==
442442

443-
asynckit@^0.4.0:
444-
version "0.4.0"
445-
resolved "https://registry.yarnpkg.com/asynckit/-/asynckit-0.4.0.tgz#c79ed97f7f34cb8f2ba1bc9790bcc366474b4b79"
446-
integrity sha1-x57Zf380y48robyXkLzDZkdLS3k=
447-
448443
atob@^2.1.1:
449444
version "2.1.2"
450445
resolved "https://registry.yarnpkg.com/atob/-/atob-2.1.2.tgz#6d9517eb9e030d2436666651e86bd9f6f13533c9"
@@ -707,19 +702,12 @@ colors@1.0.3:
707702
resolved "https://registry.yarnpkg.com/colors/-/colors-1.0.3.tgz#0433f44d809680fdeb60ed260f1b0c262e82a40b"
708703
integrity sha1-BDP0TYCWgP3rYO0mDxsMJi6CpAs=
709704

710-
combined-stream@^1.0.6:
711-
version "1.0.8"
712-
resolved "https://registry.yarnpkg.com/combined-stream/-/combined-stream-1.0.8.tgz#c3d45a8b34fd730631a110a8a2520682b31d5a7f"
713-
integrity sha512-FQN4MRfuJeHf7cBbBMJFXhKSDq+2kAArBlmRBvcvFE5BB1HZKXtSFASDhdlz9zOYwxh8lDdnvmMOe/+5cdoEdg==
714-
dependencies:
715-
delayed-stream "~1.0.0"
716-
717705
common-tags@^1.8.0:
718706
version "1.8.0"
719707
resolved "https://registry.yarnpkg.com/common-tags/-/common-tags-1.8.0.tgz#8e3153e542d4a39e9b10554434afaaf98956a937"
720708
integrity sha512-6P6g0uetGpW/sdyUy/iQQCbFF0kWVMSIVSyYz7Zgjcgh8mgw8PQzDNZeyZ5DQ2gM7LBoZPHmnjz8rUthkBG5tw==
721709

722-
component-emitter@^1.2.0, component-emitter@^1.2.1:
710+
component-emitter@^1.2.1:
723711
version "1.3.0"
724712
resolved "https://registry.yarnpkg.com/component-emitter/-/component-emitter-1.3.0.tgz#16e4070fba8ae29b679f2215853ee181ab2eabc0"
725713
integrity sha512-Rd3se6QB+sO1TwqZjscQrurpEPIfO0/yYnSin6Q/rD3mOutHvUrCAhJub3r90uNb+SESBuE0QYoB90YdfatsRg==
@@ -761,11 +749,6 @@ cookie@0.4.0:
761749
resolved "https://registry.yarnpkg.com/cookie/-/cookie-0.4.0.tgz#beb437e7022b3b6d49019d088665303ebe9c14ba"
762750
integrity sha512-+Hp8fLp57wnUSt0tY0tHEXh4voZRDnoIrZPqlo3DPiI4y9lwg/jqx+1Om94/W6ZaPDOUbnjOt/99w66zk+l1Xg==
763751

764-
cookiejar@^2.1.0:
765-
version "2.1.2"
766-
resolved "https://registry.yarnpkg.com/cookiejar/-/cookiejar-2.1.2.tgz#dd8a235530752f988f9a0844f3fc589e3111125c"
767-
integrity sha512-Mw+adcfzPxcPeI+0WlvRrr/3lGVO0bD75SxX6811cxSh1Wbxx7xZBGK1eVtDf6si8rg2lhnUjsVLMFMfbRIuwA==
768-
769752
cookies@~0.7.1:
770753
version "0.7.3"
771754
resolved "https://registry.yarnpkg.com/cookies/-/cookies-0.7.3.tgz#7912ce21fbf2e8c2da70cf1c3f351aecf59dadfa"
@@ -836,13 +819,6 @@ debug@2.6.9, debug@^2.2.0, debug@^2.3.3, debug@^2.6.8, debug@^2.6.9:
836819
dependencies:
837820
ms "2.0.0"
838821

839-
debug@^3.1.0:
840-
version "3.2.6"
841-
resolved "https://registry.yarnpkg.com/debug/-/debug-3.2.6.tgz#e83d17de16d8a7efb7717edbe5fb10135eee629b"
842-
integrity sha512-mel+jf7nrtEl5Pn1Qx46zARXKDpBbvzezse7p7LqINmdoIk8PYP5SySaxEmYv6TZ0JyEKA1hsCId6DIhgITtWQ==
843-
dependencies:
844-
ms "^2.1.1"
845-
846822
debug@^4.0.1:
847823
version "4.1.1"
848824
resolved "https://registry.yarnpkg.com/debug/-/debug-4.1.1.tgz#3b72260255109c6b589cee050f1d516139664791"
@@ -923,11 +899,6 @@ define-property@^2.0.2:
923899
is-descriptor "^1.0.2"
924900
isobject "^3.0.1"
925901

926-
delayed-stream@~1.0.0:
927-
version "1.0.0"
928-
resolved "https://registry.yarnpkg.com/delayed-stream/-/delayed-stream-1.0.0.tgz#df3ae199acadfb7d440aaae0b29e2272b24ec619"
929-
integrity sha1-3zrhmayt+31ECqrgsp4icrJOxhk=
930-
931902
delegates@^1.0.0:
932903
version "1.0.0"
933904
resolved "https://registry.yarnpkg.com/delegates/-/delegates-1.0.0.tgz#84c6e159b81904fdca59a0ef44cd870d31250f9a"
@@ -1411,11 +1382,6 @@ extend-shallow@^3.0.0, extend-shallow@^3.0.2:
14111382
assign-symbols "^1.0.0"
14121383
is-extendable "^1.0.1"
14131384

1414-
extend@^3.0.0:
1415-
version "3.0.2"
1416-
resolved "https://registry.yarnpkg.com/extend/-/extend-3.0.2.tgz#f8b1136b4071fbd8eb140aff858b1019ec2915fa"
1417-
integrity sha512-fjquC59cD7CyW6urNXK0FBufkZcoiGG80wTuPujX590cB5Ttln20E2UB4S/WARVqhXffZl2LNgS+gQdPIIim/g==
1418-
14191385
external-editor@^3.0.3:
14201386
version "3.1.0"
14211387
resolved "https://registry.yarnpkg.com/external-editor/-/external-editor-3.1.0.tgz#cb03f740befae03ea4d283caed2741a83f335495"
@@ -1551,20 +1517,6 @@ for-in@^1.0.2:
15511517
resolved "https://registry.yarnpkg.com/for-in/-/for-in-1.0.2.tgz#81068d295a8142ec0ac726c6e2200c30fb6d5e80"
15521518
integrity sha1-gQaNKVqBQuwKxybG4iAMMPttXoA=
15531519

1554-
form-data@^2.3.1:
1555-
version "2.5.1"
1556-
resolved "https://registry.yarnpkg.com/form-data/-/form-data-2.5.1.tgz#f2cbec57b5e59e23716e128fe44d4e5dd23895f4"
1557-
integrity sha512-m21N3WOmEEURgk6B9GLOE4RuWOFf28Lhh9qGYeNlGq4VDXUlJy2th2slBNU8Gp8EzloYZOibZJ7t5ecIrFSjVA==
1558-
dependencies:
1559-
asynckit "^0.4.0"
1560-
combined-stream "^1.0.6"
1561-
mime-types "^2.1.12"
1562-
1563-
formidable@^1.2.0:
1564-
version "1.2.1"
1565-
resolved "https://registry.yarnpkg.com/formidable/-/formidable-1.2.1.tgz#70fb7ca0290ee6ff961090415f4b3df3d2082659"
1566-
integrity sha512-Fs9VRguL0gqGHkXS5GQiMCr1VhZBxz0JnJs4JmMp/2jL18Fmbzvv7vOFRU+U8TBkHEE/CX1qDXzJplVULgsLeg==
1567-
15681520
forwarded@~0.1.2:
15691521
version "0.1.2"
15701522
resolved "https://registry.yarnpkg.com/forwarded/-/forwarded-0.1.2.tgz#98c23dab1175657b8c0573e8ceccd91b0ff18c84"
@@ -2433,7 +2385,7 @@ merge2@^1.2.3:
24332385
resolved "https://registry.yarnpkg.com/merge2/-/merge2-1.2.4.tgz#c9269589e6885a60cf80605d9522d4b67ca646e3"
24342386
integrity sha512-FYE8xI+6pjFOhokZu0We3S5NKCirLbCzSh2Usf3qEyr4X8U+0jNg9P8RZ4qz+V2UoECLVwSyzU3LxXBaLGtD3A==
24352387

2436-
methods@^1.1.1, methods@^1.1.2, methods@~1.1.2:
2388+
methods@~1.1.2:
24372389
version "1.1.2"
24382390
resolved "https://registry.yarnpkg.com/methods/-/methods-1.1.2.tgz#5529a4d67654134edcc5266656835b0f851afcee"
24392391
integrity sha1-VSmk1nZUE07cxSZmVoNbD4Ua/O4=
@@ -2470,14 +2422,14 @@ mime-db@1.40.0:
24702422
resolved "https://registry.yarnpkg.com/mime-db/-/mime-db-1.40.0.tgz#a65057e998db090f732a68f6c276d387d4126c32"
24712423
integrity sha512-jYdeOMPy9vnxEqFRRo6ZvTZ8d9oPb+k18PKoYNYUe2stVEBPPwsln/qWzdbmaIvnhZ9v2P+CuecK+fpUfsV2mA==
24722424

2473-
mime-types@^2.1.12, mime-types@^2.1.18, mime-types@~2.1.24:
2425+
mime-types@^2.1.18, mime-types@~2.1.24:
24742426
version "2.1.24"
24752427
resolved "https://registry.yarnpkg.com/mime-types/-/mime-types-2.1.24.tgz#b6f8d0b3e951efb77dedeca194cff6d16f676f81"
24762428
integrity sha512-WaFHS3MCl5fapm3oLxU4eYDw77IQM2ACcxQ9RIxfaC3ooc6PFuBMGZZsYpvoXS5D5QTWPieo1jjLdAm3TBP3cQ==
24772429
dependencies:
24782430
mime-db "1.40.0"
24792431

2480-
mime@1.6.0, mime@^1.4.1:
2432+
mime@1.6.0:
24812433
version "1.6.0"
24822434
resolved "https://registry.yarnpkg.com/mime/-/mime-1.6.0.tgz#32cd9e5c64553bd58d19a568af452acff04981b1"
24832435
integrity sha512-x0Vn8spI+wuJ1O6S7gnbaQg8Pxh4NNHb7KSINmEWKiPE4RKOplvijn+NkmYmmRgP68mc70j2EbeTFRsrswaQeg==
@@ -2985,7 +2937,7 @@ qs@6.7.0:
29852937
resolved "https://registry.yarnpkg.com/qs/-/qs-6.7.0.tgz#41dc1a015e3d581f1621776be31afb2876a9b1bc"
29862938
integrity sha512-VCdBRNFTX1fyE7Nb6FYoURo/SPe62QCaAyzJvUjwRaIsc+NePBEniHlvxFmmX56+HZphIGtV0XeCirBtpDrTyQ==
29872939

2988-
qs@^6.5.1, qs@^6.5.2:
2940+
qs@^6.5.2:
29892941
version "6.8.0"
29902942
resolved "https://registry.yarnpkg.com/qs/-/qs-6.8.0.tgz#87b763f0d37ca54200334cd57bb2ef8f68a1d081"
29912943
integrity sha512-tPSkj8y92PfZVbinY1n84i1Qdx75lZjMQYx9WZhnkofyxzw2r7Ho39G3/aEvSUdebxpnnM4LZJCtvE/Aq3+s9w==
@@ -3071,7 +3023,7 @@ read-pkg@^5.1.1:
30713023
parse-json "^5.0.0"
30723024
type-fest "^0.6.0"
30733025

3074-
readable-stream@2, readable-stream@^2.3.5:
3026+
readable-stream@2:
30753027
version "2.3.6"
30763028
resolved "https://registry.yarnpkg.com/readable-stream/-/readable-stream-2.3.6.tgz#b11c27d88b8ff1fbe070643cf94b0c79ae1b0aaf"
30773029
integrity sha512-tQtKA9WIAhBF3+VLAseyMqZeBjW0AHJoxOtYqSUZNJxauErmLbVm2FW1y+J/YA9dUrAC39ITejlZWhVIwawkKw==
@@ -3568,30 +3520,6 @@ super-split@^1.1.0:
35683520
resolved "https://registry.yarnpkg.com/super-split/-/super-split-1.1.0.tgz#43b3ba719155f4d43891a32729d59b213d9155fc"
35693521
integrity sha512-I4bA5mgcb6Fw5UJ+EkpzqXfiuvVGS/7MuND+oBxNFmxu3ugLNrdIatzBLfhFRMVMLxgSsRy+TjIktgkF9RFSNQ==
35703522

3571-
superagent@^3.8.3:
3572-
version "3.8.3"
3573-
resolved "https://registry.yarnpkg.com/superagent/-/superagent-3.8.3.tgz#460ea0dbdb7d5b11bc4f78deba565f86a178e128"
3574-
integrity sha512-GLQtLMCoEIK4eDv6OGtkOoSMt3D+oq0y3dsxMuYuDvaNUvuT8eFBuLmfR0iYYzHC1e8hpzC6ZsxbuP6DIalMFA==
3575-
dependencies:
3576-
component-emitter "^1.2.0"
3577-
cookiejar "^2.1.0"
3578-
debug "^3.1.0"
3579-
extend "^3.0.0"
3580-
form-data "^2.3.1"
3581-
formidable "^1.2.0"
3582-
methods "^1.1.1"
3583-
mime "^1.4.1"
3584-
qs "^6.5.1"
3585-
readable-stream "^2.3.5"
3586-
3587-
supertest@^4.0.2:
3588-
version "4.0.2"
3589-
resolved "https://registry.yarnpkg.com/supertest/-/supertest-4.0.2.tgz#c2234dbdd6dc79b6f15b99c8d6577b90e4ce3f36"
3590-
integrity sha512-1BAbvrOZsGA3YTCWqbmh14L0YEq0EGICX/nBnfkfVJn7SrxQV1I3pMYjSzG9y/7ZU2V9dWqyqk2POwxlb09duQ==
3591-
dependencies:
3592-
methods "^1.1.2"
3593-
superagent "^3.8.3"
3594-
35953523
supports-color@^5.0.0, supports-color@^5.3.0:
35963524
version "5.5.0"
35973525
resolved "https://registry.yarnpkg.com/supports-color/-/supports-color-5.5.0.tgz#e2e69a44ac8772f78a1ec0b35b689df6530efc8f"

0 commit comments

Comments
 (0)