bosia 0.8.12 → 0.8.13

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "bosia",
-	"version": "0.8.12",
+	"version": "0.8.13",
 	"type": "module",
 	"description": "A fast, batteries-included fullstack framework — SSR · Svelte 5 Runes · Bun · ElysiaJS. File-based routing No Node.js, no Vite, no adapters.",
 	"keywords": [

package/src/core/csrf.ts

@@ -10,6 +10,14 @@ export interface CsrfConfig {
 	checkOrigin: boolean;
 	/** Additional origins to allow (e.g. CDN or mobile app origin). */
 	allowedOrigins?: string[];
+	/**
+	 * Request paths exempt from the origin check — for server-to-server webhooks
+	 * that carry no Origin/Referer. Matched exact or on a path boundary
+	 * ("/webhook" also covers "/webhook/…", but not "/webhooky"). Exempt routes
+	 * bypass CSRF entirely, so they MUST authenticate the caller themselves
+	 * (verify a webhook token/signature).
+	 */
+	exemptPaths?: string[];
 }
 
 const DEFAULT_CSRF_CONFIG: CsrfConfig = {
@@ -18,6 +26,18 @@ const DEFAULT_CSRF_CONFIG: CsrfConfig = {
 
 const SAFE_METHODS = new Set(["GET", "HEAD", "OPTIONS"]);
 
+// Exact match, or a prefix match on a path boundary so "/webhook" covers
+// "/webhook/xendit" but never "/webhooky". Prefix-boundary, no globs — swap in a
+// matcher if wildcard path segments are ever needed.
+function isPathExempt(pathname: string, patterns: string[]): boolean {
+	for (const p of patterns) {
+		if (pathname === p) return true;
+		const prefix = p.endsWith("/") ? p : p + "/";
+		if (pathname.startsWith(prefix)) return true;
+	}
+	return false;
+}
+
 /**
  * Check whether a request passes CSRF validation.
  * Returns `null` on success, or an error message string to reject with 403.
@@ -29,6 +49,7 @@ export function checkCsrf(
 ): string | null {
 	if (!config.checkOrigin) return null;
 	if (SAFE_METHODS.has(request.method.toUpperCase())) return null;
+	if (config.exemptPaths && isPathExempt(url.pathname, config.exemptPaths)) return null;
 
 	// Derive the expected origin.
 	// `X-Forwarded-*` headers are only trusted when `TRUST_PROXY=true`, since a

package/src/core/env.ts

@@ -8,6 +8,7 @@ const FRAMEWORK_VARS = new Set([
 	"NODE_ENV",
 	"BODY_SIZE_LIMIT",
 	"CSRF_ALLOWED_ORIGINS",
+	"CSRF_EXEMPT_PATHS",
 	"INTERNAL_HOSTS",
 	"CORS_ALLOWED_ORIGINS",
 	"CORS_ALLOWED_METHODS",

package/src/core/server.ts

@@ -113,10 +113,12 @@ function splitCsvEnv(key: string): string[] | undefined {
 // ─── CSRF Config ─────────────────────────────────────────
 
 const _csrfAllowedOrigins = splitCsvEnv("CSRF_ALLOWED_ORIGINS");
+const _csrfExemptPaths = splitCsvEnv("CSRF_EXEMPT_PATHS");
 
 const CSRF_CONFIG: CsrfConfig = {
 	checkOrigin: true,
 	allowedOrigins: _csrfAllowedOrigins,
+	exemptPaths: _csrfExemptPaths,
 };
 
 if (_csrfAllowedOrigins?.length) {
@@ -125,6 +127,11 @@ if (_csrfAllowedOrigins?.length) {
 	console.log("🛡️  CSRF: same-origin only");
 }
 
+if (_csrfExemptPaths?.length) {
+	// These paths skip the origin check — they must authenticate callers themselves.
+	console.warn(`⚠️  CSRF exempt paths (must self-authenticate): ${_csrfExemptPaths.join(", ")}`);
+}
+
 // ─── CORS Config ──────────────────────────────────────────
 
 const _corsAllowedOrigins = splitCsvEnv("CORS_ALLOWED_ORIGINS");

package/templates/default/.env.example

@@ -65,6 +65,12 @@ PUBLIC_STATIC_APP_NAME=My Bosia App
 # Leave unset to allow same-origin requests only.
 # CSRF_ALLOWED_ORIGINS=
 
+# Comma-separated request paths exempt from the CSRF origin check — for
+# server-to-server webhooks that send no Origin/Referer. Matched exact or on a
+# path boundary ("/webhook" covers "/webhook/..." but not "/webhooky"). Exempt
+# routes bypass CSRF, so they MUST verify the caller (webhook token/signature).
+# CSRF_EXEMPT_PATHS=/webhook/xendit
+
 # Comma-separated list of origins allowed to make cross-origin requests.
 # Leave unset to disable CORS.
 # CORS_ALLOWED_ORIGINS=

package/templates/demo/.env.example

@@ -21,6 +21,11 @@ BODY_SIZE_LIMIT=512K
 # Example: https://app.example.com, https://admin.example.com
 CSRF_ALLOWED_ORIGINS=
 
+# Comma-separated request paths exempt from the CSRF origin check — for
+# server-to-server webhooks that send no Origin/Referer. Exempt routes MUST
+# verify the caller themselves (webhook token/signature). Example: /webhook/xendit
+CSRF_EXEMPT_PATHS=
+
 # Comma-separated list of origins allowed to make cross-origin requests.
 # Leave unset to disable CORS (browsers block cross-origin requests by default).
 # Example: https://app.example.com, http://localhost:5173