@riocrypto/common-server 1.0.1910 → 1.0.1911
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
|
@@ -17,15 +17,15 @@ const jsonwebtoken_1 = __importDefault(require("jsonwebtoken"));
|
|
|
17
17
|
const secret_manager_client_1 = require("../clients/secret-manager-client");
|
|
18
18
|
const common_1 = require("@riocrypto/common");
|
|
19
19
|
const verifyCsrfToken = (req, res, next) => __awaiter(void 0, void 0, void 0, function* () {
|
|
20
|
-
const CSRF_TOKEN_SECRET = yield secret_manager_client_1.secretManagerClient.getSecretValue("CSRF_TOKEN_SECRET");
|
|
21
|
-
if (!CSRF_TOKEN_SECRET) {
|
|
22
|
-
throw new common_1.SecretManagerError();
|
|
23
|
-
}
|
|
24
20
|
// Check for the presence of accessToken or adminAccessToken cookies
|
|
25
21
|
const hasAccessToken = req.cookies.accessToken || req.cookies.adminAccessToken;
|
|
26
22
|
// Only apply CSRF check if accessToken or adminAccessToken cookies are present
|
|
27
23
|
if (hasAccessToken &&
|
|
28
24
|
["POST", "PUT", "PATCH", "DELETE"].includes(req.method.toUpperCase())) {
|
|
25
|
+
const CSRF_TOKEN_SECRET = yield secret_manager_client_1.secretManagerClient.getSecretValue("CSRF_TOKEN_SECRET");
|
|
26
|
+
if (!CSRF_TOKEN_SECRET) {
|
|
27
|
+
throw new common_1.SecretManagerError();
|
|
28
|
+
}
|
|
29
29
|
// Retrieve CSRF token from the header
|
|
30
30
|
const csrfToken = Array.isArray(req.headers["x-csrf-token"])
|
|
31
31
|
? req.headers["x-csrf-token"][0]
|