@stacksjs/defaults 0.70.278 → 0.70.280

package/app/Middleware/Csrf.ts

@@ -97,6 +97,28 @@ export function generateCsrfToken(): string {
  * - 2-hour `Max-Age` — short enough to limit replay if leaked, long
  *   enough that idle tabs don't constantly re-fetch tokens
  */
+/**
+ * Whether a response is already handing the browser a CSRF token.
+ *
+ * `getSetCookie` is the only way to read multiple `Set-Cookie` headers back;
+ * `get` joins them into one string, which is not something a cookie value can
+ * be parsed out of reliably. Older runtimes without it fall back to the joined
+ * form, where a substring match is still correct for the question being asked.
+ */
+function responseAlreadySeeds(response: Response): boolean {
+  const headers = response.headers as Headers & { getSetCookie?: () => string[] }
+  const cookies = typeof headers.getSetCookie === 'function'
+    ? headers.getSetCookie()
+    : [headers.get('set-cookie') || '']
+
+  return cookies.some(cookie =>
+    cookie.startsWith(`${CSRF_COOKIE_NAME}=`)
+    || cookie.startsWith('csrf-token=')
+    || cookie.includes(`, ${CSRF_COOKIE_NAME}=`)
+    || cookie.includes(', csrf-token='),
+  )
+}
+
 export function seedCsrfCookieIfMissing(req: Request, response: Response, minted?: string): Response {
   const cookieHeader = req.headers.get('cookie') || ''
 
@@ -109,6 +131,15 @@ export function seedCsrfCookieIfMissing(req: Request, response: Response, minted
     return response
   }
 
+  // A token already on its way to the browser counts as present, exactly like
+  // one in the request. Something upstream can mint before the render - the
+  // stx dev server does, so a page's forms carry a token on a first visit -
+  // and appending a second here would leave the browser storing the last
+  // Set-Cookie while the page embedded the first. Two tokens fail the same way
+  // no token does, and are far harder to see.
+  if (responseAlreadySeeds(response))
+    return response
+
   const token = minted || generateCsrfToken()
   const isSecure = req.url.startsWith('https://')
   const cookie = [

package/ide/vscode/package.json

@@ -2,7 +2,7 @@
   "publisher": "Stacks",
   "name": "vscode-stacks",
   "displayName": "Stacks",
-  "version": "0.70.278",
+  "version": "0.70.280",
   "description": "A modern Stacks development environment.",
   "license": "MIT",
   "funding": "https://github.com/sponsors/chrisbbreuer",

package/package.json

@@ -2,7 +2,7 @@
   "name": "@stacksjs/defaults",
   "type": "module",
   "sideEffects": false,
-  "version": "0.70.278",
+  "version": "0.70.280",
   "description": "The complete managed Stacks application scaffold, including runtime defaults, AI guidance, editor metadata, and npm-backed project support files.",
   "author": "Chris Breuer",
   "license": "MIT",