@graphql-yoga/plugin-csrf-prevention 3.0.2 → 3.1.1-alpha-20240101184114-61b4f2f6

package/cjs/index.js

@@ -2,6 +2,11 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.useCSRFPrevention = void 0;
 const graphql_yoga_1 = require("graphql-yoga");
+const NON_PREFLIGHTED_CONTENT_TYPES = [
+    'application/x-www-form-urlencoded',
+    'multipart/form-data',
+    'text/plain',
+];
 /**
  * If you have CORS enabled, almost all requests coming from the browser will have a
  * preflight request - however, some requests are deemed "simple" and don't make a preflight.
@@ -17,16 +22,26 @@ function useCSRFPrevention(options = {}) {
     const { requestHeaders = ['x-graphql-yoga-csrf'] } = options;
     return {
         async onRequestParse({ request }) {
-            if (!requestHeaders.some(headerName => request.headers.has(headerName))) {
-                throw (0, graphql_yoga_1.createGraphQLError)('Required CSRF header(s) not present', {
-                    extensions: {
-                        http: {
-                            status: 403,
-                        },
-                    },
-                });
+            if (wasTheRequestAlreadyPreflightChecked(request.headers?.get('content-type'))) {
+                return;
+            }
+            if (requestHeaders.some(headerName => request.headers.has(headerName))) {
+                return;
             }
+            throw (0, graphql_yoga_1.createGraphQLError)('Required CSRF header(s) not present', {
+                extensions: {
+                    http: {
+                        status: 403,
+                    },
+                },
+            });
         },
     };
 }
 exports.useCSRFPrevention = useCSRFPrevention;
+const wasTheRequestAlreadyPreflightChecked = (contentType) => {
+    if (!contentType) {
+        return false;
+    }
+    return !NON_PREFLIGHTED_CONTENT_TYPES.some(nonPreflightContentType => contentType.toLowerCase().startsWith(nonPreflightContentType));
+};

package/esm/index.js

@@ -1,4 +1,9 @@
 import { createGraphQLError } from 'graphql-yoga';
+const NON_PREFLIGHTED_CONTENT_TYPES = [
+    'application/x-www-form-urlencoded',
+    'multipart/form-data',
+    'text/plain',
+];
 /**
  * If you have CORS enabled, almost all requests coming from the browser will have a
  * preflight request - however, some requests are deemed "simple" and don't make a preflight.
@@ -14,15 +19,25 @@ export function useCSRFPrevention(options = {}) {
     const { requestHeaders = ['x-graphql-yoga-csrf'] } = options;
     return {
         async onRequestParse({ request }) {
-            if (!requestHeaders.some(headerName => request.headers.has(headerName))) {
-                throw createGraphQLError('Required CSRF header(s) not present', {
-                    extensions: {
-                        http: {
-                            status: 403,
-                        },
-                    },
-                });
+            if (wasTheRequestAlreadyPreflightChecked(request.headers?.get('content-type'))) {
+                return;
+            }
+            if (requestHeaders.some(headerName => request.headers.has(headerName))) {
+                return;
             }
+            throw createGraphQLError('Required CSRF header(s) not present', {
+                extensions: {
+                    http: {
+                        status: 403,
+                    },
+                },
+            });
         },
     };
 }
+const wasTheRequestAlreadyPreflightChecked = (contentType) => {
+    if (!contentType) {
+        return false;
+    }
+    return !NON_PREFLIGHTED_CONTENT_TYPES.some(nonPreflightContentType => contentType.toLowerCase().startsWith(nonPreflightContentType));
+};

package/package.json

@@ -1,9 +1,9 @@
 {
   "name": "@graphql-yoga/plugin-csrf-prevention",
-  "version": "3.0.2",
+  "version": "3.1.1-alpha-20240101184114-61b4f2f6",
   "description": "CSRF prevention plugin for GraphQL Yoga that requires the clients to have a specific header set.",
   "peerDependencies": {
-    "graphql-yoga": "^5.0.2"
+    "graphql-yoga": "^5.1.0"
   },
   "repository": {
     "type": "git",