@holo-js/security 0.3.19 → 0.3.20

package/dist/{chunk-G3HBF4Q5.mjs → chunk-5SCCUNBO.mjs}

@@ -293,28 +293,6 @@ function getHeaderToken(request) {
   const { header } = getSecurityRuntime().config.csrf;
   return request.headers.get(header)?.trim() || void 0;
 }
-function getRequestOrigin(request) {
-  const origin = request.headers.get("origin")?.trim();
-  if (origin) {
-    return origin;
-  }
-  const referer = request.headers.get("referer")?.trim();
-  if (!referer) {
-    return void 0;
-  }
-  try {
-    return new URL(referer).origin;
-  } catch {
-    return void 0;
-  }
-}
-function isSameOriginRequest(request) {
-  const requestOrigin = getRequestOrigin(request);
-  if (!requestOrigin) {
-    return false;
-  }
-  return requestOrigin === new URL(request.url).origin;
-}
 async function readFormToken(request) {
   const { field: field2 } = getSecurityRuntime().config.csrf;
   try {
@@ -343,9 +321,6 @@ async function verifyRequest(request, options) {
     }
     return;
   }
-  if (isSameOriginRequest(request)) {
-    return;
-  }
   const requestToken = await readFormToken(request);
   if (requestToken !== cookieToken) {
     throw new SecurityCsrfError();
@@ -432,7 +407,6 @@ var csrfInternals = {
   getCookieToken,
   getHeaderToken,
   isSecureRequest,
-  isSameOriginRequest,
   readFormToken,
   isExcludedPath,
   isSafeMethod,

package/dist/{chunk-5M3RHQIG.mjs → chunk-CTRTL4CO.mjs}

@@ -3,7 +3,7 @@ import {
   getSecurityRuntime,
   isSecureRequest,
   token
-} from "./chunk-G3HBF4Q5.mjs";
+} from "./chunk-5SCCUNBO.mjs";
 import {
   SECURITY_CLIENT_CONFIG_COOKIE,
   createSecurityClientConfig,

package/dist/index.d.ts

@@ -23,7 +23,6 @@ declare function decodeCsrfToken(token: string): {
 declare function isValidSignedCsrfToken(token: string): boolean;
 declare function getCookieToken(request: Request): string | undefined;
 declare function getHeaderToken(request: Request): string | undefined;
-declare function isSameOriginRequest(request: Request): boolean;
 declare function readFormToken(request: Request): Promise<string | undefined>;
 declare function token(request: Request): Promise<string>;
 declare function field(request: Request): Promise<SecurityCsrfField>;
@@ -45,7 +44,6 @@ declare const csrfInternals: {
     getCookieToken: typeof getCookieToken;
     getHeaderToken: typeof getHeaderToken;
     isSecureRequest: typeof isSecureRequest;
-    isSameOriginRequest: typeof isSameOriginRequest;
     readFormToken: typeof readFormToken;
     isExcludedPath: typeof isExcludedPath;
     isSafeMethod: typeof isSafeMethod;

package/dist/index.mjs

@@ -34,7 +34,7 @@ import {
   token,
   verify,
   verifySignedToken
-} from "./chunk-G3HBF4Q5.mjs";
+} from "./chunk-5SCCUNBO.mjs";
 import {
   SecurityCsrfError,
   SecurityRateLimitError,

package/dist/next/server.mjs

@@ -1,9 +1,11 @@
 import {
   prepareCsrfCookies
-} from "../chunk-5M3RHQIG.mjs";
+} from "../chunk-CTRTL4CO.mjs";
 import {
+  cors,
+  getSecurityRuntime,
   protect
-} from "../chunk-G3HBF4Q5.mjs";
+} from "../chunk-5SCCUNBO.mjs";
 import "../chunk-FUOZWKHK.mjs";
 import {
   SecurityCsrfError
@@ -38,8 +40,34 @@ async function issueCsrfCookie(request) {
   }
   return response;
 }
+async function actionRequest(request) {
+  const { field, header } = getSecurityRuntime().config.csrf;
+  if (!request.headers.has("next-action") || request.headers.get(header)?.trim() || !request.headers.get("content-type")?.startsWith("multipart/form-data")) return request;
+  try {
+    const data = await request.clone().formData();
+    const root = data.get("0");
+    if (typeof root !== "string") return request;
+    const args = JSON.parse(root);
+    if (!Array.isArray(args)) return request;
+    for (const argument of args) {
+      if (typeof argument !== "string") continue;
+      const part = /^\$K([0-9a-f]+)$/.exec(argument)?.[1];
+      if (!part) continue;
+      const token = data.get(`_${Number.parseInt(part, 16)}_${field}`);
+      if (typeof token !== "string") continue;
+      const headers = new Headers(request.headers);
+      headers.set(header, token);
+      return new Request(request.clone(), { headers });
+    }
+  } catch {
+    return request;
+  }
+  return request;
+}
 function csrfProtection() {
   return async (request) => {
+    const preflight = cors.preflight(request);
+    if (preflight) return preflight;
     if (request.method.trim().toUpperCase() === "TRACE") {
       return new Response("Method Not Allowed", {
         status: 405,
@@ -47,14 +75,18 @@ function csrfProtection() {
       });
     }
     try {
-      await protect(request);
+      await protect(await actionRequest(request));
     } catch (error) {
       if (error instanceof SecurityCsrfError) {
-        return createCsrfErrorResponse(error);
+        return cors.apply(request, createCsrfErrorResponse(error));
       }
       throw error;
     }
-    return await issueCsrfCookie(request);
+    const response = await issueCsrfCookie(request);
+    if (response) return cors.apply(request, response);
+    if ([...cors.headers(request)].length === 0) return void 0;
+    const { NextResponse } = await import("next/server.js");
+    return cors.apply(request, NextResponse.next());
   };
 }
 var nextSecurityInternals = {

package/dist/nuxt/server.mjs

@@ -1,9 +1,10 @@
 import {
   prepareCsrfCookies
-} from "../chunk-5M3RHQIG.mjs";
+} from "../chunk-CTRTL4CO.mjs";
 import {
+  cors,
   protect
-} from "../chunk-G3HBF4Q5.mjs";
+} from "../chunk-5SCCUNBO.mjs";
 import "../chunk-FUOZWKHK.mjs";
 import {
   SecurityCsrfError
@@ -19,11 +20,12 @@ import {
   getRequestHeaders,
   getRequestURL,
   readRawBody,
-  setCookie
+  setCookie,
+  setResponseHeader
 } from "h3";
 function isSafeMethod(method) {
   const normalized = method.trim().toUpperCase();
-  return normalized === "GET" || normalized === "HEAD";
+  return normalized === "GET" || normalized === "HEAD" || normalized === "OPTIONS";
 }
 function createHeaders(event) {
   const headers = new Headers();
@@ -67,6 +69,9 @@ function csrfProtection() {
       });
     }
     const request = await createRequest(event);
+    const preflight = cors.preflight(request);
+    if (preflight) return preflight;
+    cors.headers(request).forEach((value, name) => setResponseHeader(event, name, value));
     try {
       await protect(request);
     } catch (error) {

package/dist/sveltekit/server.mjs

@@ -1,9 +1,10 @@
 import {
   prepareCsrfCookies
-} from "../chunk-5M3RHQIG.mjs";
+} from "../chunk-CTRTL4CO.mjs";
 import {
+  cors,
   protect
-} from "../chunk-G3HBF4Q5.mjs";
+} from "../chunk-5SCCUNBO.mjs";
 import "../chunk-FUOZWKHK.mjs";
 import {
   SecurityCsrfError
@@ -27,6 +28,8 @@ function createCsrfErrorResponse(error) {
 }
 function csrfProtection() {
   return async ({ event, resolve }) => {
+    const preflight = cors.preflight(event.request);
+    if (preflight) return preflight;
     if (event.request.method.trim().toUpperCase() === "TRACE") {
       return new Response("Method Not Allowed", {
         status: 405,
@@ -37,12 +40,12 @@ function csrfProtection() {
       await protect(event.request);
     } catch (error) {
       if (error instanceof SecurityCsrfError) {
-        return createCsrfErrorResponse(error);
+        return cors.apply(event.request, createCsrfErrorResponse(error));
       }
       throw error;
     }
     await issueCsrfCookie(event);
-    return resolve(event);
+    return cors.apply(event.request, await resolve(event));
   };
 }
 var svelteKitSecurityInternals = {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@holo-js/security",
-  "version": "0.3.19",
+  "version": "0.3.20",
   "description": "Holo-JS Framework - CSRF and rate-limit contracts, config, and runtime seams",
   "type": "module",
   "license": "MIT",
@@ -58,8 +58,8 @@
     "test": "vitest --run --coverage"
   },
   "dependencies": {
-    "@holo-js/config": "^0.3.19",
-    "@holo-js/kernel": "^0.3.19"
+    "@holo-js/config": "^0.3.20",
+    "@holo-js/kernel": "^0.3.20"
   },
   "peerDependencies": {
     "h3": "^1.15.11",