mirror of
https://github.com/Ride-The-Lightning/RTL.git
synced 2026-08-13 12:33:07 +02:00
e617fbb561
csurf has been deprecated since 2022 and pins an old cookie release with a known advisory; npm's only fix is a downgrade (issue #1634, item 2). csrf-csrf v4 implements the same double-submit-cookie pattern with an HMAC-signed, session-bound token keyed on the existing boot secret (common.secret_key). The frontend contract is unchanged: the token still arrives via the XSRF-TOKEN cookie/header and is echoed as x-xsrf-token (all token sources csurf accepted are still read), the signed cookie keeps the _csrf name (now httpOnly, secure:false to match the session cookie on plain-HTTP deployments), doubleCsrfProtection attaches req.csrfToken so app.ts keeps working, and the error code is EBADCSRFTOKEN - already handled in app.ts. The websocket upgrade check in authCheck.ts now routes through the shared middleware; upgrade requests are GETs, so its pass-through semantics are unchanged. One fix this surfaced: app.ts called req.csrfToken() twice (cookie and header). Under csurf every token validated against a stable secret; under csrf-csrf each first-visit call mints a new token, desyncing the XSRF-TOKEN cookie from the _csrf cookie it must equal. The token is now generated once per request. Tokens are session-bound, so a token stolen from one session no longer validates in another - a check csurf's cookie mode did not perform. Production npm audit drops from 6 low findings to 4, all in the crypto-browserify/elliptic chain tracked in #1634. Verified against the docker regtest fixture: both API suites (43 checks across LND, CLN and Eclair) plus a dedicated CSRF battery - valid-token auth, missing token 403, garbage token 403, cross-session replay 403, token stability across requests, the XSRF-TOKEN response header for Quickpay, and the websocket handshake. Lint and build are clean.
35 lines
1.8 KiB
JavaScript
35 lines
1.8 KiB
JavaScript
import { doubleCsrf } from 'csrf-csrf';
|
|
import { Logger } from './logger.js';
|
|
import { Common } from './common.js';
|
|
class CSRF {
|
|
constructor() {
|
|
this.logger = Logger;
|
|
this.common = Common;
|
|
// Signed double-submit-cookie protection (replaces the deprecated csurf).
|
|
// The signed token lives in the httpOnly '_csrf' cookie; the client echoes
|
|
// the same token (read from the XSRF-TOKEN cookie set in app.ts) in a
|
|
// header. The cookie is not secure-only because RTL commonly serves plain
|
|
// HTTP (matching the session cookie); token sources match what csurf
|
|
// accepted. The error code EBADCSRFTOKEN is handled in app.ts.
|
|
this.doubleCsrfUtilities = doubleCsrf({
|
|
getSecret: () => this.common.secret_key,
|
|
getSessionIdentifier: (req) => (req.session ? req.session.id : ''),
|
|
cookieName: '_csrf',
|
|
cookieOptions: { sameSite: 'strict', path: '/', secure: false, httpOnly: true },
|
|
getCsrfTokenFromRequest: (req) => (req.body && req.body._csrf) || (req.query && req.query._csrf) ||
|
|
req.headers['csrf-token'] || req.headers['xsrf-token'] ||
|
|
req.headers['x-csrf-token'] || req.headers['x-xsrf-token']
|
|
});
|
|
this.csrfProtection = this.doubleCsrfUtilities.doubleCsrfProtection;
|
|
}
|
|
mount(app) {
|
|
this.logger.log({ selectedNode: this.common.selectedNode, level: 'INFO', fileName: 'CSRF', msg: 'Setting up CSRF..' });
|
|
if (process.env.NODE_ENV !== 'development') {
|
|
app.use((req, res, next) => this.csrfProtection(req, res, next));
|
|
}
|
|
this.logger.log({ selectedNode: this.common.selectedNode, level: 'INFO', fileName: 'CSRF', msg: 'CSRF Set' });
|
|
return app;
|
|
}
|
|
;
|
|
}
|
|
export default new CSRF;
|