r/p5.js-web-editor
1
0
Fork 0
Code Issues 1 Pull requests Releases 1 Wiki Activity

Fixes #500 removes CSRF token setting in cookie and validation on request (#501)

Browse source
This commit is contained in:
Francis Li 2018-01-08 13:12:55 -08:00 committed by Cassie Tarakajian
parent b45e53483f
commit 2f29d6add1
1 changed files with 2 additions and 20 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

22
server/server.js
View file

@ -7,7 +7,6 @@ import session from 'express-session';
import connectMongo from 'connect-mongo'; import connectMongo from 'connect-mongo';
import passport from 'passport'; import passport from 'passport';
import path from 'path'; import path from 'path';
import csurf from 'csurf';
// Webpack Requirements // Webpack Requirements
import webpack from 'webpack'; import webpack from 'webpack';
@ -79,14 +78,6 @@ app.use(session({
}) })
})); }));
// Enables CSRF protection and stores secret in session
app.use(csurf());
// Middleware to add CSRF token as cookie to some requests
const csrfToken = (req, res, next) => {
res.cookie('XSRF-TOKEN', req.csrfToken());
next();
};
app.use(passport.initialize()); app.use(passport.initialize());
app.use(passport.session()); app.use(passport.session());
app.use('/api', requestsOfTypeJSON(), users); app.use('/api', requestsOfTypeJSON(), users);
@ -97,9 +88,9 @@ app.use('/api', requestsOfTypeJSON(), aws);
app.use(assetRoutes); app.use(assetRoutes);
// this is supposed to be TEMPORARY -- until i figure out // this is supposed to be TEMPORARY -- until i figure out
// isomorphic rendering // isomorphic rendering
app.use('/', csrfToken, serverRoutes); app.use('/', serverRoutes);
app.use('/', csrfToken, embedRoutes); app.use('/', embedRoutes);
app.get('/auth/github', passport.authenticate('github')); app.get('/auth/github', passport.authenticate('github'));
app.get('/auth/github/callback', passport.authenticate('github', { failureRedirect: '/login' }), (req, res) => { app.get('/auth/github/callback', passport.authenticate('github', { failureRedirect: '/login' }), (req, res) => {
res.redirect('/'); res.redirect('/');
@ -135,15 +126,6 @@ app.get('*', (req, res) => {
res.type('txt').send('Not found.'); res.type('txt').send('Not found.');
}); });
// error handler
app.use((err, req, res, next) => {
if (err.code !== 'EBADCSRFTOKEN') return next(err);
console.error('Invalid CSRF Token.');
console.error(req.url);
return next(err);
});
// start app // start app
app.listen(serverConfig.port, (error) => { app.listen(serverConfig.port, (error) => {
if (!error) { if (!error) {