Please review my code rather than telling me to use a trusted NPM package like csurf
.
What are some potential weaknesses with the following implementation?
'use strict'
const express = require('express'),
router = express.Router(),
crypt = require('../services/crypt')
router.use((req, res, next) => {
if (req.session.csrfToken === undefined) {
req.session.csrfToken = crypt.randHex(64) // this uses Crypto.randomBytes(); gives a hex of length 64
// alt: res.locals.csrfToken = crypt.hash('sha256', req.session.csrfToken + req.headers.host) // also using Crypto
}
res.locals.csrfToken = req.session.csrfToken
}
module.exports = router
I put the res.locals.csrfToken
in all forms with method="post"
, and this middleware is always used:
'use strict'
const express = require('express'),
router = express.Router()
router.post('*', (req, res, next) => {
if (req.session.csrfToken !== req.body.csrfToken) {
// alt: if (crypt.hash('sha256', req.session.csrfToken + req.headers.host) !== req.body.csrfToken) {
let err = new Error('Invalid CSRF Token!')
err.status = 403
return next(err)
}
return next()
})
module.exports = router
I am using HTTPS, and my express-session
options look something like this:
{
name: 'sessid',
resave: false,
saveUninitialized: false,
secret: 'djt84nq7y4tnvwosufvgsudih3rve783vdk'
}
Will the alternative (alt) implementation help any?