bun-plugin-stx 0.2.300 → 0.2.302

package/dist/serve.d.ts

@@ -19,6 +19,18 @@ export declare function extractServerScriptsFromTemplate(content: string): {
  * reject the very form they are about to submit.
  */
 export declare function csrfTokenToMint(req: Request, cookies: Record<string, string>): string | null;
+/**
+ * Whether the finished response is a page, the only thing a minted token is for.
+ *
+ * The mint is decided before the render, from the request, and the request
+ * cannot say reliably what it is asking for: browsers send a wildcard (any
+ * type) in the Accept of a stylesheet, a script and an image alike, so every asset a first-time
+ * visitor loaded went out with its own `Set-Cookie: X-CSRF-Token`. That made
+ * each one a response no shared cache will store - behind Cloudflare a whole
+ * site's assets came back `cf-cache-status: BYPASS` - and handed out a fresh
+ * token per asset while the page had embedded another. The response knows.
+ */
+export declare function responseTakesCsrfCookie(response: Response): boolean;
 /** The `Set-Cookie` value for a minted token. Readable by script, as double-submit requires. */
 export declare function csrfCookieHeader(token: string, secure: boolean): string;
 export declare function buildDynamicRouteRegexes(fileRouteBase: string): RegExp[];

package/dist/serve.js

@@ -8865,6 +8865,10 @@ function csrfTokenToMint(req, cookies) {
   crypto.getRandomValues(bytes);
   return [...bytes].map((byte) => byte.toString(16).padStart(2, "0")).join("");
 }
+function responseTakesCsrfCookie(response) {
+  const type = ((response.headers.get("content-type") || "").split(";")[0] ?? "").trim().toLowerCase();
+  return type === "text/html" || type === "application/xhtml+xml";
+}
 function csrfCookieHeader(token, secure) {
   return [
     `${CSRF_COOKIE}=${token}`,
@@ -10982,7 +10986,7 @@ ${trailingPageScripts.join(`
               }
             })();
             let _finalResp = await applyI18nToResponse(_i18nResp, i18nLocale ?? (i18nConfig?.defaultLocale ?? "en"), path);
-            if (mintedCsrfToken) {
+            if (mintedCsrfToken && responseTakesCsrfCookie(_finalResp)) {
               try {
                 _finalResp.headers.append("Set-Cookie", csrfCookieHeader(mintedCsrfToken, req.url.startsWith("https://")));
               } catch {
@@ -11105,6 +11109,7 @@ export {
   sharedScriptCacheControl,
   serve,
   routeSpecificity,
+  responseTakesCsrfCookie,
   resolveServeOpenUrl,
   render404Page,
   publicFileExists,

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "bun-plugin-stx",
   "type": "module",
-  "version": "0.2.300",
+  "version": "0.2.302",
   "description": "A Bun plugin that allows for using Laravel Blade-like syntax.",
   "author": "Chris Breuer <chris@stacksjs.org>",
   "license": "MIT",