Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Reading body after reading body in seperate module hangs request #170

Closed
chmking opened this issue Sep 1, 2022 · 2 comments
Closed

Reading body after reading body in seperate module hangs request #170

chmking opened this issue Sep 1, 2022 · 2 comments

Comments

@chmking
Copy link
Contributor

chmking commented Sep 1, 2022

While developing a module to add csrf support for h3, I've discovered that reading the body after reading it in the module middleware does not pass the symbol conditional and attempts to parse the body a second time which causes the request to hang.

const csrf = require("@chmking/h3-csrf");
const h3 = require("h3");
const http = require("http");

const app = h3.createApp();
app.use(csrf.csrf());

app.use("/login", async (event) => {
  await h3.readBody(event);
  return "success";
});

app.use("/", (event) => {
  const token = event.req.csrfToken();
  return `<form action="/login" method="POST"><input name="_csrf" type="hidden" value="${token}"></input><input type="submit"></form>`;
});

http.createServer(app).listen(8080);

Visit localhost:8080 to get the csrf cookie and then click the submit button.

Throwing a breakpoint on await h3.readBody and inspecting the call shows the symbol in the request object but the conditional fails and does not early out as expected.

This same behavior does not occur when read twice inside the same module. There is test demonstrating this in @chmking/h3-csrf

@chmking chmking changed the title Reading body after reading body in seperate module hangs server Reading body after reading body in seperate module hangs request Sep 1, 2022
@chmking
Copy link
Contributor Author

chmking commented Sep 3, 2022

I've tried switching @chmking/h3-csrf to use h3 as a peerDependency with no improvement. After walking the code in the debugger it is very clear that it is not returning the parsed body from the previous call:

if (ParsedBodySymbol in event.req) {
  return event.req[ParsedBodySymbol];
}

Screen Shot 2022-09-03 at 7 38 02 AM

Additionally, should raw and parsed body be using the same Symbol key?

const RawBodySymbol = Symbol("h3RawBody");
const ParsedBodySymbol = Symbol("h3RawBody");

@chmking
Copy link
Contributor Author

chmking commented Sep 3, 2022

I'm fairly new to JS and Symbols, would this be fixed by using the global symbol registry for the symbols?

const RawBodySymbol = Symbol.for("h3RawBody");
const ParsedBodySymbol = Symbol.for("h3ParsedBody");

This should mean that future calls receive the same Symbol, correct?

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant