@riocrypto/common-server 1.0.1910 → 1.0.1912
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
|
@@ -1,2 +1,2 @@
|
|
|
1
1
|
import { Request, Response, NextFunction } from "express";
|
|
2
|
-
export declare const verifyCsrfToken: (req: Request, res: Response, next: NextFunction) => Promise<Response<any, Record<string, any
|
|
2
|
+
export declare const verifyCsrfToken: (req: Request, res: Response, next: NextFunction) => Promise<void | Response<any, Record<string, any>>>;
|
|
@@ -17,15 +17,19 @@ const jsonwebtoken_1 = __importDefault(require("jsonwebtoken"));
|
|
|
17
17
|
const secret_manager_client_1 = require("../clients/secret-manager-client");
|
|
18
18
|
const common_1 = require("@riocrypto/common");
|
|
19
19
|
const verifyCsrfToken = (req, res, next) => __awaiter(void 0, void 0, void 0, function* () {
|
|
20
|
-
const CSRF_TOKEN_SECRET = yield secret_manager_client_1.secretManagerClient.getSecretValue("CSRF_TOKEN_SECRET");
|
|
21
|
-
if (!CSRF_TOKEN_SECRET) {
|
|
22
|
-
throw new common_1.SecretManagerError();
|
|
23
|
-
}
|
|
24
20
|
// Check for the presence of accessToken or adminAccessToken cookies
|
|
25
21
|
const hasAccessToken = req.cookies.accessToken || req.cookies.adminAccessToken;
|
|
22
|
+
// Skip CSRF check if the request path contains "notification"
|
|
23
|
+
if (req.path.toLowerCase().includes("notification")) {
|
|
24
|
+
return next();
|
|
25
|
+
}
|
|
26
26
|
// Only apply CSRF check if accessToken or adminAccessToken cookies are present
|
|
27
27
|
if (hasAccessToken &&
|
|
28
28
|
["POST", "PUT", "PATCH", "DELETE"].includes(req.method.toUpperCase())) {
|
|
29
|
+
const CSRF_TOKEN_SECRET = yield secret_manager_client_1.secretManagerClient.getSecretValue("CSRF_TOKEN_SECRET");
|
|
30
|
+
if (!CSRF_TOKEN_SECRET) {
|
|
31
|
+
throw new common_1.SecretManagerError();
|
|
32
|
+
}
|
|
29
33
|
// Retrieve CSRF token from the header
|
|
30
34
|
const csrfToken = Array.isArray(req.headers["x-csrf-token"])
|
|
31
35
|
? req.headers["x-csrf-token"][0]
|