@remix-run/csrf-middleware 0.1.2 → 0.1.4

package/README.md

@@ -21,10 +21,10 @@ This middleware requires [`session-middleware`](https://github.com/remix-run/rem
 
 ```ts
 import { createCookie } from 'remix/cookie'
-import { createRouter } from 'remix/fetch-router'
-import { createCookieSessionStorage } from 'remix/session/cookie-storage'
-import { session } from 'remix/session-middleware'
-import { csrf, getCsrfToken } from 'remix/csrf-middleware'
+import { createRouter } from 'remix/router'
+import { createCookieSessionStorage } from 'remix/session-storage/cookie'
+import { session } from 'remix/middleware/session'
+import { csrf, getCsrfToken } from 'remix/middleware/csrf'
 
 let sessionCookie = createCookie('__session', { secrets: ['secret1'] })
 let sessionStorage = createCookieSessionStorage()
@@ -49,7 +49,7 @@ router.get('/form', (context) => {
 
 By default, `csrf()` checks token values in this order:
 
-1. Request headers: `x-csrf-token`, `x-xsrf-token`, `csrf-token`
+1. Request headers: `X-Csrf-Token`, `X-Xsrf-Token`, `Csrf-Token`
 2. Form field: `_csrf` (requires `formData()` middleware to parse request bodies)
 3. Query param: `_csrf`
 

package/dist/lib/csrf.d.ts

@@ -1,4 +1,5 @@
-import type { Middleware, RequestContext, RequestMethod } from '@remix-run/fetch-router';
+import type { AnyParams, ContextEntries, Middleware, RequestContext, RequestMethod } from '@remix-run/fetch-router';
+type AnyRequestContext = RequestContext<AnyParams, ContextEntries>;
 type OriginMatcher = string | RegExp | ReadonlyArray<string | RegExp>;
 /**
  * Return shape for a dynamic CSRF origin resolver.
@@ -11,7 +12,7 @@ export interface CsrfOriginResolver {
     /**
      * Resolves whether an unsafe request origin should be trusted.
      */
-    (origin: string, context: RequestContext): CsrfOriginResolverResult | Promise<CsrfOriginResolverResult>;
+    (origin: string, context: AnyRequestContext): CsrfOriginResolverResult | Promise<CsrfOriginResolverResult>;
 }
 /**
  * Accepted forms for configuring allowed CSRF origins.
@@ -28,7 +29,7 @@ export interface CsrfTokenResolver {
     /**
      * Resolves the submitted CSRF token for the current request.
      */
-    (context: RequestContext): CsrfTokenResolverResult | Promise<CsrfTokenResolverResult>;
+    (context: AnyRequestContext): CsrfTokenResolverResult | Promise<CsrfTokenResolverResult>;
 }
 /**
  * The reason a CSRF request was rejected.
@@ -53,7 +54,7 @@ export interface CsrfOptions {
     /**
      * Header names checked (in order) for CSRF tokens.
      *
-     * @default ['x-csrf-token', 'x-xsrf-token', 'csrf-token']
+     * @default ['X-Csrf-Token', 'X-Xsrf-Token', 'Csrf-Token']
      */
     headerNames?: readonly string[];
     /**
@@ -81,7 +82,7 @@ export interface CsrfOptions {
     /**
      * Optional custom error response for rejected requests.
      */
-    onError?: (reason: CsrfFailureReason, context: RequestContext) => Response | Promise<Response>;
+    onError?: (reason: CsrfFailureReason, context: AnyRequestContext) => Response | Promise<Response>;
 }
 /**
  * Session-backed CSRF protection middleware.
@@ -99,6 +100,6 @@ export declare function csrf(options?: CsrfOptions): Middleware;
  * @param tokenKey Session key that stores the token
  * @returns The active CSRF token
  */
-export declare function getCsrfToken(context: RequestContext, tokenKey?: string): string;
+export declare function getCsrfToken(context: AnyRequestContext, tokenKey?: string): string;
 export {};
 //# sourceMappingURL=csrf.d.ts.map

package/dist/lib/csrf.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"csrf.d.ts","sourceRoot":"","sources":["../../src/lib/csrf.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,cAAc,EAAE,aAAa,EAAE,MAAM,yBAAyB,CAAA;AAMxF,KAAK,aAAa,GAAG,MAAM,GAAG,MAAM,GAAG,aAAa,CAAC,MAAM,GAAG,MAAM,CAAC,CAAA;AAErE;;GAEG;AACH,MAAM,MAAM,wBAAwB,GAAG,OAAO,GAAG,IAAI,GAAG,SAAS,CAAA;AAEjE;;GAEG;AACH,MAAM,WAAW,kBAAkB;IACjC;;OAEG;IACH,CACE,MAAM,EAAE,MAAM,EACd,OAAO,EAAE,cAAc,GACtB,wBAAwB,GAAG,OAAO,CAAC,wBAAwB,CAAC,CAAA;CAChE;AAED;;GAEG;AACH,MAAM,MAAM,UAAU,GAAG,aAAa,GAAG,kBAAkB,CAAA;AAE3D;;GAEG;AACH,MAAM,MAAM,uBAAuB,GAAG,MAAM,GAAG,IAAI,GAAG,SAAS,CAAA;AAE/D;;GAEG;AACH,MAAM,WAAW,iBAAiB;IAChC;;OAEG;IACH,CAAC,OAAO,EAAE,cAAc,GAAG,uBAAuB,GAAG,OAAO,CAAC,uBAAuB,CAAC,CAAA;CACtF;AAED;;GAEG;AACH,MAAM,MAAM,iBAAiB,GAAG,gBAAgB,GAAG,eAAe,GAAG,eAAe,CAAA;AAEpF;;GAEG;AACH,MAAM,WAAW,WAAW;IAC1B;;;;OAIG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAA;IAEjB;;;;OAIG;IACH,SAAS,CAAC,EAAE,MAAM,CAAA;IAElB;;;;OAIG;IACH,WAAW,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;IAE/B;;;;OAIG;IACH,WAAW,CAAC,EAAE,SAAS,aAAa,EAAE,CAAA;IAEtC;;;;OAIG;IACH,MAAM,CAAC,EAAE,UAAU,CAAA;IAEnB;;;;OAIG;IACH,kBAAkB,CAAC,EAAE,OAAO,CAAA;IAE5B;;OAEG;IACH,KAAK,CAAC,EAAE,iBAAiB,CAAA;IAEzB;;OAEG;IACH,OAAO,CAAC,EAAE,CAAC,MAAM,EAAE,iBAAiB,EAAE,OAAO,EAAE,cAAc,KAAK,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAA;CAC/F;AAED;;;;;;;GAOG;AACH,wBAAgB,IAAI,CAAC,OAAO,GAAE,WAAgB,GAAG,UAAU,CAwC1D;AAED;;;;;;GAMG;AACH,wBAAgB,YAAY,CAAC,OAAO,EAAE,cAAc,EAAE,QAAQ,SAAU,GAAG,MAAM,CAehF"}
+{"version":3,"file":"csrf.d.ts","sourceRoot":"","sources":["../../src/lib/csrf.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EACV,SAAS,EACT,cAAc,EACd,UAAU,EACV,cAAc,EACd,aAAa,EACd,MAAM,yBAAyB,CAAA;AAMhC,KAAK,iBAAiB,GAAG,cAAc,CAAC,SAAS,EAAE,cAAc,CAAC,CAAA;AAClE,KAAK,aAAa,GAAG,MAAM,GAAG,MAAM,GAAG,aAAa,CAAC,MAAM,GAAG,MAAM,CAAC,CAAA;AAErE;;GAEG;AACH,MAAM,MAAM,wBAAwB,GAAG,OAAO,GAAG,IAAI,GAAG,SAAS,CAAA;AAEjE;;GAEG;AACH,MAAM,WAAW,kBAAkB;IACjC;;OAEG;IACH,CACE,MAAM,EAAE,MAAM,EACd,OAAO,EAAE,iBAAiB,GACzB,wBAAwB,GAAG,OAAO,CAAC,wBAAwB,CAAC,CAAA;CAChE;AAED;;GAEG;AACH,MAAM,MAAM,UAAU,GAAG,aAAa,GAAG,kBAAkB,CAAA;AAE3D;;GAEG;AACH,MAAM,MAAM,uBAAuB,GAAG,MAAM,GAAG,IAAI,GAAG,SAAS,CAAA;AAE/D;;GAEG;AACH,MAAM,WAAW,iBAAiB;IAChC;;OAEG;IACH,CAAC,OAAO,EAAE,iBAAiB,GAAG,uBAAuB,GAAG,OAAO,CAAC,uBAAuB,CAAC,CAAA;CACzF;AAED;;GAEG;AACH,MAAM,MAAM,iBAAiB,GAAG,gBAAgB,GAAG,eAAe,GAAG,eAAe,CAAA;AAEpF;;GAEG;AACH,MAAM,WAAW,WAAW;IAC1B;;;;OAIG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAA;IAEjB;;;;OAIG;IACH,SAAS,CAAC,EAAE,MAAM,CAAA;IAElB;;;;OAIG;IACH,WAAW,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;IAE/B;;;;OAIG;IACH,WAAW,CAAC,EAAE,SAAS,aAAa,EAAE,CAAA;IAEtC;;;;OAIG;IACH,MAAM,CAAC,EAAE,UAAU,CAAA;IAEnB;;;;OAIG;IACH,kBAAkB,CAAC,EAAE,OAAO,CAAA;IAE5B;;OAEG;IACH,KAAK,CAAC,EAAE,iBAAiB,CAAA;IAEzB;;OAEG;IACH,OAAO,CAAC,EAAE,CAAC,MAAM,EAAE,iBAAiB,EAAE,OAAO,EAAE,iBAAiB,KAAK,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAA;CAClG;AAED;;;;;;;GAOG;AACH,wBAAgB,IAAI,CAAC,OAAO,GAAE,WAAgB,GAAG,UAAU,CAwC1D;AAMD;;;;;;GAMG;AACH,wBAAgB,YAAY,CAAC,OAAO,EAAE,iBAAiB,EAAE,QAAQ,SAAU,GAAG,MAAM,CAenF"}

package/dist/lib/csrf.js

@@ -1,6 +1,7 @@
+import { isRequestMethod } from '@remix-run/fetch-router';
 import { Session } from '@remix-run/session';
 const defaultSafeMethods = ['GET', 'HEAD', 'OPTIONS'];
-const defaultTokenHeaderNames = ['x-csrf-token', 'x-xsrf-token', 'csrf-token'];
+const defaultTokenHeaderNames = ['X-Csrf-Token', 'X-Xsrf-Token', 'Csrf-Token'];
 /**
  * Session-backed CSRF protection middleware.
  *
@@ -16,11 +17,11 @@ export function csrf(options = {}) {
     let headerNames = options.headerNames ?? defaultTokenHeaderNames;
     let allowMissingOrigin = options.allowMissingOrigin ?? true;
     return async (context, next) => {
-        if (!context.has(Session)) {
+        if (context.get(Session) == null) {
             throw new Error('csrf middleware requires session() middleware to run before it');
         }
         let expectedToken = getCsrfToken(context, tokenKey);
-        if (safeMethods.includes(context.method)) {
+        if (isSafeMethod(context.method, safeMethods)) {
             return next();
         }
         let validOrigin = await validateRequestOrigin(context, options.origin, allowMissingOrigin, context.url.origin);
@@ -37,6 +38,9 @@ export function csrf(options = {}) {
         return next();
     };
 }
+function isSafeMethod(method, safeMethods) {
+    return isRequestMethod(method) && safeMethods.includes(method);
+}
 /**
  * Gets the CSRF token from the session. Creates one if missing.
  *
@@ -45,10 +49,10 @@ export function csrf(options = {}) {
  * @returns The active CSRF token
  */
 export function getCsrfToken(context, tokenKey = '_csrf') {
-    if (!context.has(Session)) {
+    let session = context.get(Session);
+    if (session == null) {
         throw new Error('Session is not started. Use session() middleware before csrf().');
     }
-    let session = context.get(Session);
     let token = session.get(tokenKey);
     if (typeof token === 'string' && token !== '') {
         return token;
@@ -97,7 +101,7 @@ async function resolveSubmittedToken(context, valueResolver, fieldName, headerNa
             return trimmedHeaderValue;
         }
     }
-    let formValue = context.has(FormData) ? context.get(FormData).get(fieldName) : undefined;
+    let formValue = context.get(FormData)?.get(fieldName);
     if (typeof formValue === 'string') {
         let trimmedFormValue = formValue.trim();
         if (trimmedFormValue !== '') {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@remix-run/csrf-middleware",
-  "version": "0.1.2",
+  "version": "0.1.4",
   "description": "Middleware for CSRF protection in Fetch API servers",
   "author": "Michael Jackson <mjijackson@gmail.com>",
   "license": "MIT",
@@ -28,17 +28,17 @@
   "devDependencies": {
     "@types/node": "^24.6.0",
     "@typescript/native-preview": "7.0.0-dev.20251125.1",
-    "@remix-run/cookie": "0.5.1",
-    "@remix-run/fetch-router": "0.18.2",
-    "@remix-run/assert": "0.2.0",
-    "@remix-run/session": "0.4.1",
-    "@remix-run/form-data-middleware": "0.2.3",
-    "@remix-run/test": "0.3.0",
-    "@remix-run/session-middleware": "0.2.2"
+    "@remix-run/assert": "0.2.1",
+    "@remix-run/form-data-middleware": "0.3.1",
+    "@remix-run/cookie": "0.5.3",
+    "@remix-run/session": "0.4.2",
+    "@remix-run/fetch-router": "0.19.1",
+    "@remix-run/session-middleware": "0.3.1",
+    "@remix-run/test": "0.4.1"
   },
   "dependencies": {
-    "@remix-run/fetch-router": "^0.18.2",
-    "@remix-run/session": "^0.4.1"
+    "@remix-run/fetch-router": "^0.19.1",
+    "@remix-run/session": "^0.4.2"
   },
   "keywords": [
     "fetch",

package/src/lib/csrf.ts

@@ -1,9 +1,17 @@
-import type { Middleware, RequestContext, RequestMethod } from '@remix-run/fetch-router'
+import { isRequestMethod } from '@remix-run/fetch-router'
+import type {
+  AnyParams,
+  ContextEntries,
+  Middleware,
+  RequestContext,
+  RequestMethod,
+} from '@remix-run/fetch-router'
 import { Session } from '@remix-run/session'
 
 const defaultSafeMethods: RequestMethod[] = ['GET', 'HEAD', 'OPTIONS']
-const defaultTokenHeaderNames = ['x-csrf-token', 'x-xsrf-token', 'csrf-token']
+const defaultTokenHeaderNames = ['X-Csrf-Token', 'X-Xsrf-Token', 'Csrf-Token']
 
+type AnyRequestContext = RequestContext<AnyParams, ContextEntries>
 type OriginMatcher = string | RegExp | ReadonlyArray<string | RegExp>
 
 /**
@@ -20,7 +28,7 @@ export interface CsrfOriginResolver {
    */
   (
     origin: string,
-    context: RequestContext,
+    context: AnyRequestContext,
   ): CsrfOriginResolverResult | Promise<CsrfOriginResolverResult>
 }
 
@@ -41,7 +49,7 @@ export interface CsrfTokenResolver {
   /**
    * Resolves the submitted CSRF token for the current request.
    */
-  (context: RequestContext): CsrfTokenResolverResult | Promise<CsrfTokenResolverResult>
+  (context: AnyRequestContext): CsrfTokenResolverResult | Promise<CsrfTokenResolverResult>
 }
 
 /**
@@ -70,7 +78,7 @@ export interface CsrfOptions {
   /**
    * Header names checked (in order) for CSRF tokens.
    *
-   * @default ['x-csrf-token', 'x-xsrf-token', 'csrf-token']
+   * @default ['X-Csrf-Token', 'X-Xsrf-Token', 'Csrf-Token']
    */
   headerNames?: readonly string[]
 
@@ -103,7 +111,7 @@ export interface CsrfOptions {
   /**
    * Optional custom error response for rejected requests.
    */
-  onError?: (reason: CsrfFailureReason, context: RequestContext) => Response | Promise<Response>
+  onError?: (reason: CsrfFailureReason, context: AnyRequestContext) => Response | Promise<Response>
 }
 
 /**
@@ -122,13 +130,13 @@ export function csrf(options: CsrfOptions = {}): Middleware {
   let allowMissingOrigin = options.allowMissingOrigin ?? true
 
   return async (context, next) => {
-    if (!context.has(Session)) {
+    if (context.get(Session) == null) {
       throw new Error('csrf middleware requires session() middleware to run before it')
     }
 
     let expectedToken = getCsrfToken(context, tokenKey)
 
-    if (safeMethods.includes(context.method)) {
+    if (isSafeMethod(context.method, safeMethods)) {
       return next()
     }
 
@@ -156,6 +164,10 @@ export function csrf(options: CsrfOptions = {}): Middleware {
   }
 }
 
+function isSafeMethod(method: string, safeMethods: readonly RequestMethod[]): boolean {
+  return isRequestMethod(method) && safeMethods.includes(method)
+}
+
 /**
  * Gets the CSRF token from the session. Creates one if missing.
  *
@@ -163,12 +175,12 @@ export function csrf(options: CsrfOptions = {}): Middleware {
  * @param tokenKey Session key that stores the token
  * @returns The active CSRF token
  */
-export function getCsrfToken(context: RequestContext, tokenKey = '_csrf'): string {
-  if (!context.has(Session)) {
+export function getCsrfToken(context: AnyRequestContext, tokenKey = '_csrf'): string {
+  let session = context.get(Session)
+  if (session == null) {
     throw new Error('Session is not started. Use session() middleware before csrf().')
   }
 
-  let session = context.get(Session)
   let token = session.get(tokenKey)
   if (typeof token === 'string' && token !== '') {
     return token
@@ -195,7 +207,7 @@ function createCsrfToken(): string {
 function getErrorResponse(
   options: CsrfOptions,
   reason: CsrfFailureReason,
-  context: RequestContext,
+  context: AnyRequestContext,
 ): Response | Promise<Response> {
   if (options.onError) {
     return options.onError(reason, context)
@@ -213,7 +225,7 @@ function getErrorResponse(
 }
 
 async function resolveSubmittedToken(
-  context: RequestContext,
+  context: AnyRequestContext,
   valueResolver: CsrfTokenResolver | undefined,
   fieldName: string,
   headerNames: readonly string[],
@@ -240,7 +252,7 @@ async function resolveSubmittedToken(
     }
   }
 
-  let formValue = context.has(FormData) ? context.get(FormData).get(fieldName) : undefined
+  let formValue = context.get(FormData)?.get(fieldName)
   if (typeof formValue === 'string') {
     let trimmedFormValue = formValue.trim()
     if (trimmedFormValue !== '') {
@@ -258,7 +270,7 @@ async function resolveSubmittedToken(
 }
 
 async function validateRequestOrigin(
-  context: RequestContext,
+  context: AnyRequestContext,
   configuredOrigin: CsrfOrigin | undefined,
   allowMissingOrigin: boolean,
   defaultOrigin: string,
@@ -298,7 +310,7 @@ async function validateRequestOrigin(
   return false
 }
 
-function getRequestOrigin(context: RequestContext): string | null {
+function getRequestOrigin(context: AnyRequestContext): string | null {
   let origin = context.headers.get('Origin')
   if (origin != null && origin.trim() !== '') {
     return origin