@blamejs/blamejs-shop 0.3.0 → 0.3.1

package/CHANGELOG.md

@@ -8,6 +8,8 @@ upgrading across more than a few patches at a time.
 
 ## v0.3.x
 
+- v0.3.1 (2026-05-30) — **Fix CSRF origin check refusing authenticated forms behind a TLS-terminating proxy.** The token-based CSRF protection added in 0.3.0 runs an Origin/Referer pre-check on every state-changing request. When the app is served behind a proxy that terminates TLS and forwards plain HTTP to the application — a CDN or load balancer, the standard production topology — the application saw the connection as HTTP and rebuilt its own origin as `http://<host>`, while the browser's request carried `Origin: https://<host>`. That bare scheme mismatch made the check refuse every legitimate same-origin POST as cross-origin, blocking sign-in and every account and admin form. The CSRF gate now trusts the forwarded protocol header — the same proxy stance the session cookies already use — so it derives the real public origin, and it matches against an explicit allowlist of the public origin(s), configurable via SHOP_PUBLIC_ORIGINS. The token cookie also regains its `__Host-` prefix over the forwarded HTTPS connection. No operator action is required for the default origin. **Fixed:** *Authenticated forms no longer refused behind a TLS-terminating proxy* — The CSRF origin pre-check derived the application origin from the raw proxied connection scheme, so a same-origin browser POST carrying `Origin: https://<host>` was refused as cross-origin under a CDN that forwards plain HTTP. The gate now trusts the forwarded `x-forwarded-proto` and matches against an explicit public-origin allowlist — `SHOP_PUBLIC_ORIGINS` (comma-separated), defaulting to the canonical origin — so sign-in and the account and admin forms submit correctly. The double-submit token cookie also regains its `__Host-` prefix over the forwarded HTTPS connection.
+
 - v0.3.0 (2026-05-30) — **Token-based CSRF protection on the account and admin forms.** Every state-changing form on the customer account surface — subscriptions, addresses, wishlist, returns, reviews, loyalty, referrals, passkey management, profile, checkout — and the entire admin console now carries a per-request double-submit CSRF token that is validated on submission. This is a defense-in-depth layer on top of the existing SameSite session cookies and the fetch-metadata cross-site gate. It lands with an update of the vendored blamejs runtime to v0.13.46, whose createApp now wires CSRF into the request lifecycle by default (closing the long-standing gap where it was documented but not enforced). The edge-rendered, cached storefront forms (add-to-cart, cookie consent, newsletter, currency switch) keep their SameSite + fetch-metadata defense — a per-session token cannot be embedded in HTML that is cached and identical for every visitor, and forcing one would break no-JS submission. No operator action or configuration change is required. **Security:** *Per-form CSRF tokens on account and admin* — The container-rendered account and admin forms now embed a hidden `_csrf` field carrying a per-request double-submit token; the server validates it (constant-time) on every state-changing POST. The passkey enrolment / sign-in islands send the matching token in the `X-CSRF-Token` header. This is layered on top of — not a replacement for — the SameSite session cookies and the fetch-metadata cross-site refusal already in place. · *Vendored blamejs runtime updated to v0.13.46* — createApp now wires CSRF (double-submit cookie), plus the cookie / CSP-nonce / fetch-metadata / body-parser layers, into the request lifecycle by default. The shop adopts the CSRF default scoped so the edge-cached, dual-rendered storefront endpoints (cart, consent, newsletter, currency) remain on their SameSite + fetch-metadata defense, while the authenticated account and admin surfaces gain the token check. A lint rule now flags any new edge-rendered POST form that would need that exemption.
 
 ## v0.2.x

package/lib/asset-manifest.json

@@ -1,5 +1,5 @@
 {
-  "version": "0.3.0",
+  "version": "0.3.1",
   "assets": {
     "css/admin.css": {
       "integrity": "sha384-1SIn6oAf1DjECbRfKENZasdKHJiywGdXR58wn0hsFGcdVHzUmvfgMkEz5ANIAZJ3",

package/lib/security-middleware.js

@@ -108,6 +108,20 @@ var EDGE_POST_PATHS = [
   "/announcements/",
 ];
 
+// The TLS-terminated public origin(s) the storefront is served on. Behind
+// the Cloudflare Worker the container socket is plain http, so the CSRF
+// origin pre-check would otherwise build `http://<host>` and refuse every
+// same-origin browser POST (which carries `Origin: https://<host>`) on a
+// bare scheme mismatch — breaking sign-in and every authenticated form.
+// The csrf gate below trusts the Worker-forwarded `x-forwarded-proto` (so
+// it derives the real https origin) AND carries this explicit allowlist as
+// belt-and-suspenders for the public host. Override with the comma-
+// separated SHOP_PUBLIC_ORIGINS for an alternate deploy; the default is
+// the canonical origin the Worker + storefront already use as their
+// fallback.
+var PUBLIC_ORIGINS = (process.env.SHOP_PUBLIC_ORIGINS || "https://blamejs.shop")
+  .split(",").map(function (s) { return s.trim(); }).filter(Boolean);
+
 /**
  * Resolve the real client IP for rate-limit keying. Reads the
  * Cloudflare-injected `cf-connecting-ip` first (the canonical single
@@ -184,7 +198,21 @@ function mountRouteGuards(r) {
   // shells render it into a hidden `_csrf` field. `skipStateless` passes
   // cookie-less and bearer-token (Authorization-header) requests through —
   // they cannot be CSRF-ed (no ambient cookie credential to abuse).
-  var csrfGate = b.middleware.csrfProtect({ cookie: true, skipStateless: true });
+  var csrfGate = b.middleware.csrfProtect({
+    cookie:        true,
+    skipStateless: true,
+    // Behind the Cloudflare Worker the container connection is plain http
+    // while the visitor is on https; trustProxy opts in the Worker-set
+    // `x-forwarded-proto` so the origin pre-check derives the real public
+    // origin (and the token cookie carries the `__Host-csrf` prefix),
+    // matching the session-cookie stance (storefront `_secureForReq`).
+    // allowedOrigins is the explicit public-host allowlist so a legitimate
+    // same-origin POST is never refused as cross-origin on a proxy
+    // scheme/host mismatch — the regression that breaks sign-in + every
+    // authenticated form behind the CDN.
+    trustProxy:     true,
+    allowedOrigins: PUBLIC_ORIGINS,
+  });
   r.use(function csrfGuard(req, res, next) {
     var pathname = req.pathname || req.url || "/";
     if (_hasPrefix(pathname, WEBHOOK_PATHS) || pathname === HEALTH_PATH) return next();

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@blamejs/blamejs-shop",
-  "version": "0.3.0",
+  "version": "0.3.1",
   "description": "Open-source framework built on blamejs. Vendored stack, zero npm runtime deps, PQC-first crypto, security-on by default.",
   "main": "lib/index.js",
   "scripts": {