@porulle/core 0.74.1 → 0.74.3

package/dist/runtime/server.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"server.d.ts","sourceRoot":"","sources":["../../src/runtime/server.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAQhD,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,kBAAkB,CAAC;AAC9C,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AACrD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAC;AAQzD,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AAC1C,OAAO,EAAkB,KAAK,gBAAgB,EAAE,MAAM,eAAe,CAAC;AAStE,KAAK,SAAS,GAAG;IACf,SAAS,EAAE;QACT,IAAI,EAAE,YAAY,CAAC;QACnB,KAAK,EAAE,KAAK,GAAG,IAAI,CAAC;QACpB,SAAS,EAAE,MAAM,CAAC;QAClB,MAAM,EAAE,MAAM,CAAC;KAChB,CAAC;CACH,CAAC;AAEF;;;;;;;GAOG;AACH,wBAAgB,aAAa,IAAI,OAAO,CAcvC;AAeD;;;;;GAKG;AACH,wBAAsB,YAAY,CAAC,MAAM,EAAE,cAAc;;;;;sBAwXxB,MAAM,UAAU,MAAM;GA8GtD"}
+{"version":3,"file":"server.d.ts","sourceRoot":"","sources":["../../src/runtime/server.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAQhD,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,kBAAkB,CAAC;AAC9C,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AACrD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAC;AAQzD,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AAC1C,OAAO,EAAkB,KAAK,gBAAgB,EAAE,MAAM,eAAe,CAAC;AAStE,KAAK,SAAS,GAAG;IACf,SAAS,EAAE;QACT,IAAI,EAAE,YAAY,CAAC;QACnB,KAAK,EAAE,KAAK,GAAG,IAAI,CAAC;QACpB,SAAS,EAAE,MAAM,CAAC;QAClB,MAAM,EAAE,MAAM,CAAC;KAChB,CAAC;CACH,CAAC;AAEF;;;;;;;GAOG;AACH,wBAAgB,aAAa,IAAI,OAAO,CAcvC;AAeD;;;;;GAKG;AACH,wBAAsB,YAAY,CAAC,MAAM,EAAE,cAAc;;;;;sBAgYxB,MAAM,UAAU,MAAM;GA8GtD"}

package/dist/runtime/server.js

@@ -166,11 +166,20 @@ export async function createServer(config) {
             ? trustedOrigins
             : (process.env.NODE_ENV === "production" ? [] : ["http://localhost:*"]),
     });
+    //
+    // The same reasoning covers a request that carries NO credential at all: with no cookie there is
+    // nothing ambient for a forged request to ride on. A store's webhook is exactly that — WooCommerce
+    // pings a new subscription with a cookieless, Origin-less form POST and refuses to create the
+    // subscription unless it is answered 2xx. The one cookieless forgery that matters is login CSRF
+    // (signing a victim into the attacker's account), so the auth routes keep the check regardless.
     app.use("/api/*", async (c, next) => {
         const authenticatedByKey = !!c.req.header("x-api-key") ||
             /^Bearer\s+/i.test(c.req.header("authorization") ?? "");
         if (authenticatedByKey)
             return next();
+        const ambientCredential = !!c.req.header("cookie");
+        if (!ambientCredential && !c.req.path.startsWith("/api/auth/"))
+            return next();
         // Run only the CSRF origin check here; invoke the real downstream afterwards
         // so a genuine 403 from a route handler can't be misattributed to CSRF.
         let passedCsrf = false;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@porulle/core",
-  "version": "0.74.1",
+  "version": "0.74.3",
   "license": "MIT",
   "type": "module",
   "exports": {

package/src/runtime/server.ts

@@ -204,11 +204,19 @@ export async function createServer(config: CommerceConfig) {
       ? trustedOrigins
       : (process.env.NODE_ENV === "production" ? [] : ["http://localhost:*"]),
   });
+  //
+  // The same reasoning covers a request that carries NO credential at all: with no cookie there is
+  // nothing ambient for a forged request to ride on. A store's webhook is exactly that — WooCommerce
+  // pings a new subscription with a cookieless, Origin-less form POST and refuses to create the
+  // subscription unless it is answered 2xx. The one cookieless forgery that matters is login CSRF
+  // (signing a victim into the attacker's account), so the auth routes keep the check regardless.
   app.use("/api/*", async (c, next) => {
     const authenticatedByKey =
       !!c.req.header("x-api-key") ||
       /^Bearer\s+/i.test(c.req.header("authorization") ?? "");
     if (authenticatedByKey) return next();
+    const ambientCredential = !!c.req.header("cookie");
+    if (!ambientCredential && !c.req.path.startsWith("/api/auth/")) return next();
 
     // Run only the CSRF origin check here; invoke the real downstream afterwards
     // so a genuine 403 from a route handler can't be misattributed to CSRF.