csurf has been deprecated since 2022 and pins an old cookie release
with a known advisory; npm's only fix is a downgrade (issue #1634,
item 2). csrf-csrf v4 implements the same double-submit-cookie pattern
with an HMAC-signed, session-bound token keyed on the existing boot
secret (common.secret_key).
The frontend contract is unchanged: the token still arrives via the
XSRF-TOKEN cookie/header and is echoed as x-xsrf-token (all token
sources csurf accepted are still read), the signed cookie keeps the
_csrf name (now httpOnly, secure:false to match the session cookie on
plain-HTTP deployments), doubleCsrfProtection attaches req.csrfToken
so app.ts keeps working, and the error code is EBADCSRFTOKEN - already
handled in app.ts. The websocket upgrade check in authCheck.ts now
routes through the shared middleware; upgrade requests are GETs, so
its pass-through semantics are unchanged.
One fix this surfaced: app.ts called req.csrfToken() twice (cookie and
header). Under csurf every token validated against a stable secret;
under csrf-csrf each first-visit call mints a new token, desyncing the
XSRF-TOKEN cookie from the _csrf cookie it must equal. The token is
now generated once per request.
Tokens are session-bound, so a token stolen from one session no longer
validates in another - a check csurf's cookie mode did not perform.
Production npm audit drops from 6 low findings to 4, all in the
crypto-browserify/elliptic chain tracked in #1634.
Verified against the docker regtest fixture: both API suites (43
checks across LND, CLN and Eclair) plus a dedicated CSRF battery -
valid-token auth, missing token 403, garbage token 403, cross-session
replay 403, token stability across requests, the XSRF-TOKEN response
header for Quickpay, and the websocket handshake. Lint and build are
clean.
* rm .DS_Store
* Add watchfrontenddev command for npm
* Fix toggle issues in sidenav (pinning and on page refresh)
* Add copy-to-clipboard fallback if navigator.clipboard is not available (#1336)
* add copy-to-clipboard fallback if navigator.clipboard is not available
* amend copy fallback
* clipboard copy lint fixes and frontend build
* fix: add missing boltz state `transaction.lockupFailed` (#1349)
* fix: boltzd docs link (#1354)
* exit gracefully (#1356)
* allow for eclair updated relayed audit format (#1363)
* feat: add boltz service to cln (#1352)
* lint fix
* Request Params Cleanup
* cln: Boltz auto-send (#1366)
* Bug-fix (CLN Boltz): Hide claim tx id and routing fee for non-zero conf reverse swap
* cln: Boltz auto-send
- Added auto send option for Swap In
- Checking compatiblity with v2.0.0 and above
* Test import fixes
* Update help.component.ts (#1379)
Fixed broken link under "Help" -> "Node Settings"
* Backend config fix (#1382)
* Updating Common Application Configuration
* Fixed get RTL Conf
* Update Application Settings
* application and settings case change
* Unified config models
* Default node update
* 2FA and Password reset
* Final application settings update
* Config Settings and Authentication case fixed
* Node Setting Fix
* Fiat currency Symbol fix
* CLN: Fiat symbol fix
* All: Fiat symbol fix
* Update node settings
* Services UI fix
* CLN: Removed child node settings
* All: Removed child node settings
* Test fixes
* mempool links for onchain information (#1383)
* Tests fix
Tests fix
* UI for Block Explorer Configuration (#1385)
* Bump fee with mempool information (#1386)
* Mempool openchannel minfee (#1388)
Open channel model block if min fee is higher
* Show error on login screen if rune is incorrect and getinfo throws error (#1391)
* cln: Removed channel lookup call for update policy (#1392)
* ECL: On-chain Transactions, Invoice and Payments pagination (#1393)
Done most of the UI changes to accommodate pagination on transactions, payments and invoices tables but true pagination cannot be implemented till total number of records are missing from the API response.
Once the issue https://github.com/ACINQ/eclair/issues/2855 is fixed, I will uncomment pagination changes in the frontend.
* lnd: Onchain CPFP (#1394)
- UTXO label bug fix
- Warning on utxo label for "sweep" in text.
* Bug fixes after testing
* Testing bug fixes (#1401)
* Bug fix 2: lnd: Link channel point to explorer and show fee on close channel too
* lnd: explorer link on pending channels
* Node lookup link on view channel peer pubkey
* Testing bug fixes (#1402)
* Bug fix 2: lnd: Link channel point to explorer and show fee on close channel too
* lnd: explorer link on pending channels
* Node lookup link on view channel peer pubkey
* test fixes
* ng update to v18.0.x
* Updating install with --legacy-peer-deps
---------
Co-authored-by: Grzegorz Kućmierz <gkucmierz@gmail.com>
Co-authored-by: lacksfish <lacksfish@gmail.com>
Co-authored-by: jackstar12 <62219658+jackstar12@users.noreply.github.com>
Co-authored-by: Kilian <19181985+kilrau@users.noreply.github.com>
Co-authored-by: Taylor King <taylorbradleyking@gmail.com>
Co-authored-by: Fishcake <128653975+fishcakeday@users.noreply.github.com>
Co-authored-by: Ant <72945059+2140data@users.noreply.github.com>
Offers QR Code bug fix
Websocket Authcheck csrf cookie validation
Bug Fix: Wrong year in Date #918
Improved INFO & DEBUG Logging
LND: Bug fix Color Setting in Config #925
2FA button toggle #906
Bug Fix: HTLC viewing #924
All Tooltips on form controls are updated with mat-icon:info
Co-authored-by: saiy2k <saiy2k@gmail.com>
