gaspersic/freeCodeCamp
1
0
Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity

fix(csrf): remove all csrf bypass

Browse Source
This commit is contained in:
Oliver Eyton-Williams
2020-03-06 17:51:58 +01:00
committed by mrugesh
parent f183df0d88
commit 23b899f50f
20 changed files with 84 additions and 56 deletions
Download Patch File Download Diff File Expand all files Collapse all files

26
api-server/server/middlewares/request-authorization.js
View File

@ -11,19 +11,23 @@ import { jwtSecret as _jwtSecret } from '../../../config/secrets';
import { wrapHandledError } from '../utils/create-handled-error';
// We need to tunnel through a proxy path set up within
// the gatsby app, at this time, that path is /internal
const apiProxyRE = /^\/internal\/|^\/external\//;
const newsShortLinksRE = /^\/internal\/n\/|^\/internal\/p\?/;
const loopbackAPIPathRE = /^\/internal\/api\//;
const showCertRe = /^\/internal\/certificate\/showCert\//;
const updatePaypalRe = /^\/internal\/donate\/update-paypal/;
const newsShortLinksRE = /^\/n\/|^\/p\//;
const showCertRE = /^\/certificate\/showCert\//;
const updatePaypalRE = /^\/donate\/update-paypal/;
// signin may not have a trailing slash
const signinRE = /^\/signin/;
const unsubscribeRE = /^\/u\/|^\/unsubscribe\/|^\/ue\//;
const unsubscribedRE = /^\/unsubscribed\//;
const resubscribeRE = /^\/resubscribe\//;
const _whiteListREs = [
newsShortLinksRE,
loopbackAPIPathRE,
showCertRe,
updatePaypalRe
showCertRE,
updatePaypalRE,
signinRE,
unsubscribeRE,
unsubscribedRE,
resubscribeRE
];
export function isWhiteListedPath(path, whiteListREs = _whiteListREs) {
@ -33,7 +37,7 @@ export function isWhiteListedPath(path, whiteListREs = _whiteListREs) {
export default ({ jwtSecret = _jwtSecret, getUserById = _getUserById } = {}) =>
function requestAuthorisation(req, res, next) {
const { path } = req;
if (apiProxyRE.test(path) && !isWhiteListedPath(path)) {
if (!isWhiteListedPath(path)) {
const { accessToken, error, jwt } = getAccessTokenFromRequest(
req,
jwtSecret