@a83/orbiter-admin 0.3.20 → 0.3.21

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@a83/orbiter-admin",
-  "version": "0.3.20",
+  "version": "0.3.21",
   "description": "Standalone admin server for Orbiter CMS",
   "type": "module",
   "main": "./src/server.js",

package/src/middleware/csrf.js

@@ -0,0 +1,37 @@
+/**
+ * CSRF protection via Origin / Referer header validation.
+ *
+ * sameSite: 'Strict' on the session cookie already blocks most CSRF vectors.
+ * This middleware adds a second layer: mutating requests (POST/PUT/PATCH/DELETE)
+ * must carry an Origin (or Referer) header that matches ALLOWED_ORIGINS.
+ *
+ * Browser fetch/XHR always sends Origin on cross-origin requests; same-origin
+ * requests send it on POST but not on GET. We only check mutating methods, so
+ * the case where Origin is absent on a same-site POST is fine — a same-site
+ * request is already allowed.
+ *
+ * Requests with no Origin AND no Referer (e.g. curl without headers, Postman)
+ * are allowed — they can't carry the session cookie cross-site anyway.
+ */
+
+const MUTATING = new Set(['POST', 'PUT', 'PATCH', 'DELETE']);
+
+export function csrfMiddleware(allowedOrigins) {
+  return async (c, next) => {
+    if (!MUTATING.has(c.req.method)) return next();
+
+    const origin  = c.req.header('origin');
+    const referer = c.req.header('referer');
+
+    // No origin/referer — non-browser client; skip check
+    if (!origin && !referer) return next();
+
+    const candidate = origin ?? new URL(referer).origin;
+
+    if (!allowedOrigins.includes(candidate)) {
+      return c.json({ error: 'CSRF check failed' }, 403);
+    }
+
+    return next();
+  };
+}

package/src/server.js

@@ -25,6 +25,7 @@ import { importRoutes }     from './routes/import.js';
 import { commentRoutes }    from './routes/comments.js';
 import { lockRoutes }       from './routes/locks.js';
 import { requireAuth }      from './middleware/auth.js';
+import { csrfMiddleware }  from './middleware/csrf.js';
 
 const { version: adminVersion } = JSON.parse(
   readFileSync(join(__dirname, '../package.json'), 'utf8')
@@ -56,6 +57,8 @@ export function createApp(podPath) {
     credentials: true,
   }));
 
+  app.use('/api/*', csrfMiddleware(ALLOWED_ORIGINS));
+
   // Public routes
   app.route('/api/auth', authRoutes);