@stacksjs/defaults 0.74.55 → 0.74.56

package/app/Actions/Auth/DisableTwoFactorAction.ts

@@ -26,12 +26,17 @@ export default new Action({
     // rather than trusting the bearer token alone (a stolen/leaked
     // token shouldn't be enough to turn off the second factor it's
     // meant to help guard against).
-    const confirmed = await Auth.validate({ email: user.email, password })
+    // Bind reconfirmation to the same account and password version while
+    // disabling. A concurrent password reset must invalidate this request.
+    const confirmed = await Auth.withVerifiedCredentials({ email: user.email, password }, async (verifiedUser) => {
+      if (String(verifiedUser.id) !== String(user.id))
+        return false
+      await disableTwoFactor(user.id as number)
+      return true
+    })
     if (!confirmed)
       return response.unauthorized('Incorrect password')
 
-    await disableTwoFactor(user.id as number)
-
     return response.json({ enabled: false })
   },
 })

package/app/Middleware/Csrf.ts

@@ -144,7 +144,34 @@ export function createCsrfCookie(req: Request, minted?: string): string {
   return `${CSRF_COOKIE_PREFIX}${token}${suffix}`
 }
 
+/**
+ * Whether a browser could go on to use a CSRF token from this response.
+ *
+ * A page carries the forms that submit it, and an API answer is what an SPA
+ * reads before its next request. A stylesheet, script, font or image is
+ * neither, and a cookie on one is worse than useless: a response that sets a
+ * cookie is one no shared cache will store, so seeding every static file kept
+ * the site's whole asset set out of the CDN (every file came back
+ * `cf-cache-status: BYPASS`). A cacheable file carrying a per-visitor token is
+ * also the shape of a leak, should any cache in the path store it anyway.
+ *
+ * No content type at all (a redirect, an empty answer) keeps the old
+ * behaviour: it says nothing about what the browser is looking at.
+ */
+export function responseMayUseCsrfToken(response: Response): boolean {
+  const type = (response.headers.get('content-type') || '').split(';')[0].trim().toLowerCase()
+  if (!type)
+    return true
+  return type === 'text/html'
+    || type === 'application/xhtml+xml'
+    || type === 'application/json'
+    || type.endsWith('+json')
+}
+
 export function seedCsrfCookieIfMissing(req: Request, response: Response, minted?: string, responseHasNoCookies = false): Response {
+  if (!responseMayUseCsrfToken(response))
+    return response
+
   // A token the router minted before rendering wins over "the header already
   // has one", because it put that value in the header itself - and the page
   // has already embedded it in every form it drew. Generating a second token

package/ide/vscode/package.json

@@ -2,7 +2,7 @@
   "publisher": "Stacks",
   "name": "vscode-stacks",
   "displayName": "Stacks",
-  "version": "0.74.55",
+  "version": "0.74.56",
   "description": "A modern Stacks development environment.",
   "license": "MIT",
   "funding": "https://github.com/sponsors/chrisbbreuer",

package/package.json

@@ -2,7 +2,7 @@
   "name": "@stacksjs/defaults",
   "type": "module",
   "sideEffects": false,
-  "version": "0.74.55",
+  "version": "0.74.56",
   "repository": {
     "type": "git",
     "url": "git+https://github.com/stacksjs/stacks.git",
@@ -55,7 +55,7 @@
   "dependencies": {
     "@iconify-json/f7": "^1.2.2",
     "@iconify-json/hugeicons": "^1.2.27",
-    "@stacksjs/mobile": "^0.74.55",
+    "@stacksjs/mobile": "^0.74.56",
     "@stacksjs/sanitizer": "^0.2.113",
     "ts-qr-codes": "^0.1.8"
   }