@oktis-works/api 0.4.16 → 0.4.17
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"csrf.d.ts","sourceRoot":"","sources":["../../src/middleware/csrf.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAU1C,eAAO,MAAM,WAAW,QAAqB,CAAC;AAC9C,eAAO,MAAM,WAAW,QAAqB,CAAC;AAE9C,wBAAgB,cAAc,IAAI,MAAM,CAEvC;
|
|
1
|
+
{"version":3,"file":"csrf.d.ts","sourceRoot":"","sources":["../../src/middleware/csrf.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAU1C,eAAO,MAAM,WAAW,QAAqB,CAAC;AAC9C,eAAO,MAAM,WAAW,QAAqB,CAAC;AAE9C,wBAAgB,cAAc,IAAI,MAAM,CAEvC;AAeD,wFAAwF;AACxF,wBAAgB,YAAY,CAAC,CAAC,EAAE,OAAO,GAAG,OAAO,CAyBhD;AAWD;;;;;;;;GAQG;AACH,wBAAsB,cAAc,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,GAAG,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC,CAkDrF"}
|
package/dist/middleware/csrf.js
CHANGED
|
@@ -10,26 +10,45 @@ export const CSRF_HEADER = csrfCfg.headerName;
|
|
|
10
10
|
export function issueCsrfToken() {
|
|
11
11
|
return randomUUID();
|
|
12
12
|
}
|
|
13
|
+
function normalizeOrigin(value) {
|
|
14
|
+
const raw = value.trim();
|
|
15
|
+
if (!raw)
|
|
16
|
+
return null;
|
|
17
|
+
const hasProtocol = /^[a-z][a-z\d+.-]*:\/\//i.test(raw);
|
|
18
|
+
try {
|
|
19
|
+
const parsed = new URL(hasProtocol ? raw : `http://${raw}`);
|
|
20
|
+
return { origin: parsed.origin, host: parsed.host, hasProtocol };
|
|
21
|
+
}
|
|
22
|
+
catch {
|
|
23
|
+
return null;
|
|
24
|
+
}
|
|
25
|
+
}
|
|
13
26
|
/** Origem esperada: mesma do Host da requisição (ou configurada em TRUSTED_ORIGINS). */
|
|
14
27
|
export function isSameOrigin(c) {
|
|
15
28
|
const origin = c.req.header('Origin') ?? c.req.header('Referer');
|
|
16
29
|
if (!origin)
|
|
17
30
|
return false;
|
|
18
|
-
|
|
19
|
-
|
|
20
|
-
originHost = new URL(origin).host;
|
|
21
|
-
}
|
|
22
|
-
catch {
|
|
31
|
+
const parsedOrigin = normalizeOrigin(origin);
|
|
32
|
+
if (!parsedOrigin)
|
|
23
33
|
return false;
|
|
24
|
-
}
|
|
25
34
|
const trusted = (process.env['TRUSTED_ORIGINS'] ?? '')
|
|
26
35
|
.split(',')
|
|
27
36
|
.map((s) => s.trim())
|
|
28
37
|
.filter(Boolean);
|
|
29
|
-
|
|
38
|
+
// Aceita tanto `localhost:3011` quanto `http://localhost:3011`, mas nunca
|
|
39
|
+
// faz wildcard: quando o protocolo é informado, a origem completa precisa
|
|
40
|
+
// ser exatamente igual (incluindo protocolo, host e porta).
|
|
41
|
+
if (trusted.some((value) => {
|
|
42
|
+
const parsedTrusted = normalizeOrigin(value);
|
|
43
|
+
if (!parsedTrusted)
|
|
44
|
+
return false;
|
|
45
|
+
return parsedTrusted.hasProtocol
|
|
46
|
+
? parsedTrusted.origin === parsedOrigin.origin
|
|
47
|
+
: parsedTrusted.host === parsedOrigin.host;
|
|
48
|
+
}))
|
|
30
49
|
return true;
|
|
31
|
-
const host = c.req.header('X-Forwarded-Host') ?? c.req.header('Host');
|
|
32
|
-
return Boolean(host) &&
|
|
50
|
+
const host = (c.req.header('X-Forwarded-Host') ?? c.req.header('Host'))?.split(',')[0]?.trim();
|
|
51
|
+
return Boolean(host) && parsedOrigin.host === host;
|
|
33
52
|
}
|
|
34
53
|
function readCookie(cookieHeader, name) {
|
|
35
54
|
if (!cookieHeader)
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"csrf.js","sourceRoot":"","sources":["../../src/middleware/csrf.ts"],"names":[],"mappings":"AAAA,0FAA0F;AAG1F,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,UAAU,EAAE,MAAM,qBAAqB,CAAC;AAEjD,MAAM,MAAM,GAAG,UAAU,EAAE,CAAC;AAC5B,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,MAAM,CAAC,IAAI,CAAC;AAEtC,MAAM,cAAc,GAAG,IAAI,GAAG,CAAC,CAAC,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,QAAQ,CAAC,CAAC,CAAC;AAEnE,wDAAwD;AACxD,MAAM,CAAC,MAAM,WAAW,GAAG,OAAO,CAAC,UAAU,CAAC;AAC9C,MAAM,CAAC,MAAM,WAAW,GAAG,OAAO,CAAC,UAAU,CAAC;AAE9C,MAAM,UAAU,cAAc;IAC5B,OAAO,UAAU,EAAE,CAAC;AACtB,CAAC;AAED,
|
|
1
|
+
{"version":3,"file":"csrf.js","sourceRoot":"","sources":["../../src/middleware/csrf.ts"],"names":[],"mappings":"AAAA,0FAA0F;AAG1F,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,UAAU,EAAE,MAAM,qBAAqB,CAAC;AAEjD,MAAM,MAAM,GAAG,UAAU,EAAE,CAAC;AAC5B,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,MAAM,CAAC,IAAI,CAAC;AAEtC,MAAM,cAAc,GAAG,IAAI,GAAG,CAAC,CAAC,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,QAAQ,CAAC,CAAC,CAAC;AAEnE,wDAAwD;AACxD,MAAM,CAAC,MAAM,WAAW,GAAG,OAAO,CAAC,UAAU,CAAC;AAC9C,MAAM,CAAC,MAAM,WAAW,GAAG,OAAO,CAAC,UAAU,CAAC;AAE9C,MAAM,UAAU,cAAc;IAC5B,OAAO,UAAU,EAAE,CAAC;AACtB,CAAC;AAED,SAAS,eAAe,CAAC,KAAa;IACpC,MAAM,GAAG,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC;IACzB,IAAI,CAAC,GAAG;QAAE,OAAO,IAAI,CAAC;IAEtB,MAAM,WAAW,GAAG,yBAAyB,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACxD,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,UAAU,GAAG,EAAE,CAAC,CAAC;QAC5D,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,WAAW,EAAE,CAAC;IACnE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,wFAAwF;AACxF,MAAM,UAAU,YAAY,CAAC,CAAU;IACrC,MAAM,MAAM,GAAG,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;IACjE,IAAI,CAAC,MAAM;QAAE,OAAO,KAAK,CAAC;IAE1B,MAAM,YAAY,GAAG,eAAe,CAAC,MAAM,CAAC,CAAC;IAC7C,IAAI,CAAC,YAAY;QAAE,OAAO,KAAK,CAAC;IAEhC,MAAM,OAAO,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,iBAAiB,CAAC,IAAI,EAAE,CAAC;SACnD,KAAK,CAAC,GAAG,CAAC;SACV,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;SACpB,MAAM,CAAC,OAAO,CAAC,CAAC;IAEnB,0EAA0E;IAC1E,0EAA0E;IAC1E,4DAA4D;IAC5D,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE;QACzB,MAAM,aAAa,GAAG,eAAe,CAAC,KAAK,CAAC,CAAC;QAC7C,IAAI,CAAC,aAAa;YAAE,OAAO,KAAK,CAAC;QACjC,OAAO,aAAa,CAAC,WAAW;YAC9B,CAAC,CAAC,aAAa,CAAC,MAAM,KAAK,YAAY,CAAC,MAAM;YAC9C,CAAC,CAAC,aAAa,CAAC,IAAI,KAAK,YAAY,CAAC,IAAI,CAAC;IAC/C,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IAEhB,MAAM,IAAI,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,kBAAkB,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC;IAC/F,OAAO,OAAO,CAAC,IAAI,CAAC,IAAI,YAAY,CAAC,IAAI,KAAK,IAAI,CAAC;AACrD,CAAC;AAED,SAAS,UAAU,CAAC,YAAgC,EAAE,IAAY;IAChE,IAAI,CAAC,YAAY;QAAE,OAAO,IAAI,CAAC;IAC/B,KAAK,MAAM,IAAI,IAAI,YAAY,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;QAC3C,MAAM,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAC9C,IAAI,GAAG,KAAK,IAAI;YAAE,OAAO,kBAAkB,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;IAC9D,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,CAAU,EAAE,IAAU;IACzD,IAAI,CAAC,OAAO,CAAC,OAAO;QAAE,OAAO,IAAI,EAAE,CAAC;IAEpC,MAAM,MAAM,GAAG,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC;IAC1C,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;QAChC,MAAM,IAAI,EAAE,CAAC;QACb,OAAO;IACT,CAAC;IAED,sCAAsC;IACtC,IAAI,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,eAAe,CAAC,EAAE,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;QACzD,MAAM,IAAI,EAAE,CAAC;QACb,OAAO;IACT,CAAC;IAED,8EAA8E;IAC9E,MAAM,MAAM,GAAG,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;IACjE,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,MAAM,IAAI,EAAE,CAAC;QACb,OAAO;IACT,CAAC;IAED,uEAAuE;IACvE,2EAA2E;IAC3E,8BAA8B;IAC9B,IAAI,CAAC,CAAC,GAAG,CAAC,IAAI,KAAK,oBAAoB,IAAI,CAAC,CAAC,GAAG,CAAC,IAAI,KAAK,uBAAuB,EAAE,CAAC;QAClF,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,CAAC;YACrB,OAAO,CAAC,CAAC,IAAI,CACX,EAAE,KAAK,EAAE,oBAAoB,EAAE,OAAO,EAAE,yBAAyB,EAAE,EACnE,GAAG,CACJ,CAAC;QACJ,CAAC;QACD,MAAM,IAAI,EAAE,CAAC;QACb,OAAO;IACT,CAAC;IAED,MAAM,YAAY,GAAG,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;IAE5C,MAAM,WAAW,GAAG,UAAU,CAAC,YAAY,EAAE,WAAW,CAAC,CAAC;IAC1D,MAAM,WAAW,GAAG,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;IAE9C,IAAI,CAAC,WAAW,IAAI,CAAC,WAAW,IAAI,WAAW,KAAK,WAAW,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,CAAC;QACpF,OAAO,CAAC,CAAC,IAAI,CACX,EAAE,KAAK,EAAE,oBAAoB,EAAE,OAAO,EAAE,yBAAyB,EAAE,EACnE,GAAG,CACJ,CAAC;IACJ,CAAC;IAED,MAAM,IAAI,EAAE,CAAC;IACb,OAAO;AACT,CAAC"}
|