@stacksjs/defaults 0.75.60 → 0.75.61

package/app/Middleware/Csrf.ts

@@ -168,10 +168,36 @@ export function responseMayUseCsrfToken(response: Response): boolean {
     || type.endsWith('+json')
 }
 
+/**
+ * Whether a response told shared caches they may keep it: its `Cache-Control`
+ * says `public` or gives an `s-maxage`, and says neither `private` nor
+ * `no-store`.
+ *
+ * Such a response is, by its own account, the same for everyone, so it must
+ * not carry a per-visitor cookie. A CDN refuses to store a response that sets
+ * one (Cloudflare answers `cf-cache-status: BYPASS`), so seeding here kept
+ * every shareable API read out of the edge; and a cache that stored it anyway
+ * would hand one visitor's token to everybody behind it.
+ */
+export function responseDeclaresShared(response: Response): boolean {
+  const value = (response.headers.get('cache-control') || '').toLowerCase()
+  if (!value || /\b(?:private|no-store)\b/.test(value))
+    return false
+  return /\bpublic\b/.test(value) || /\bs-maxage\s*=/.test(value)
+}
+
 export function seedCsrfCookieIfMissing(req: Request, response: Response, minted?: string, responseHasNoCookies = false): Response {
   if (!responseMayUseCsrfToken(response))
     return response
 
+  // Nothing depends on a shareable response seeding the cookie: a page that
+  // carries forms is per-visitor and never says `public`, and a client about to
+  // submit without a cookie can ask for one from a response that is not shared.
+  // This holds for every layer that seeds - the API router, and the page server
+  // that proxies `/api` to it - because they all come through here.
+  if (responseDeclaresShared(response))
+    return response
+
   // A token the router minted before rendering wins over "the header already
   // has one", because it put that value in the header itself - and the page
   // has already embedded it in every form it drew. Generating a second token

package/ide/vscode/package.json

@@ -2,7 +2,7 @@
   "publisher": "Stacks",
   "name": "vscode-stacks",
   "displayName": "Stacks",
-  "version": "0.75.60",
+  "version": "0.75.61",
   "description": "Stacks, built into VS Code: stx templates, pickier linting and formatting, encrypted env files, the dev server preview and every buddy command. No other extensions required.",
   "license": "MIT",
   "funding": "https://github.com/sponsors/chrisbbreuer",

package/package.json

@@ -2,7 +2,7 @@
   "name": "@stacksjs/defaults",
   "type": "module",
   "sideEffects": false,
-  "version": "0.75.60",
+  "version": "0.75.61",
   "repository": {
     "type": "git",
     "url": "git+https://github.com/stacksjs/stacks.git",
@@ -55,7 +55,7 @@
   "dependencies": {
     "@iconify-json/f7": "^1.2.2",
     "@iconify-json/hugeicons": "^1.2.35",
-    "@stacksjs/mobile": "^0.75.60",
+    "@stacksjs/mobile": "^0.75.61",
     "@stacksjs/sanitizer": "^0.2.348",
     "ts-qr-codes": "^0.1.8"
   }