Merge pull request #3351 from SillyTavern/csrf-sync Replace CSRF middleware

c9a1a3eb94bdc0b823b115e8e230380822d9e11e

Cohee <18619528+Cohee1207@users.noreply.github.com>

Signed

Parents: 44ad69ceca223f3c69bc908b017235e4bbebd53b 44ade6ad640c3bfb4f4216e6f2341ef362ff23ae

default/config.yaml+1 -1 Viewed

 ## Set to a positive number to expire session after a certain time of inactivity
 ## Set to 0 to expire session when the browser is closed
 ## Set to a negative number to disable session expiration
 sessionTimeout: 86400-1
 # Used to sign session cookies. Will be auto-generated if not set
 cookieSecret: ''
 # Disable CSRF protection - NOT RECOMMENDED

index.d.ts+18 -8 Viewed

 import { UserDirectoryList, User } from "./src/users";
 +import { CsrfSyncedToken } from "csrf-sync";
 declare global {
 +    declare namespace CookieSessionInterfaces {
 +        export interface CookieSessionObject {
 +            /**
 +             * The CSRF token for the session.
 +             */
 +            csrfToken: CsrfSyncedToken;
 +            /**
 +             * Authenticated user handle.
 +             */
 +            handle: string;
 +            /**
 +             * Last time the session was extended.
 +             */
 +            touch: number;
 +        }
 +    }
++
     namespace Express {
         export interface Request {
             user: {

      */
     var DATA_ROOT: string;
+}
+-
 -declare module 'express-session' {
 -    export interface SessionData {
 -      handle: string;
 -      touch: number;
 -      // other properties...
 -    }
 -  }

package-lock.json+5 -5 Viewed

                 "cookie-parser": "^1.4.6",
                 "cookie-session": "^2.1.0",
                 "cors": "^2.8.5",
                 "csrf-csrfsync": "^24.20.3",
                 "diff-match-patch": "^1.0.5",
                 "dompurify": "^3.1.7",
                 "droll": "^0.2.1",

                 "node": "*"
+            }
         },
         "node_modules/csrf-csrfsync": {
             "version": "24.20.43",
             "resolved": "https://registry.npmjs.org/csrf-csrfsync/-/csrf-csrfsync-24.20.43.tgz",
             "integrity": "sha512-LuhBmy5RfRmEfeqeYqgaAuS1eDpVtKZB/Eiec9xiKQLBynJxrGVRdM2yRTwXzltBBzt/YMl1Njo7imzDt6ZT7G/yKh2L9AYsIwSlTPnx2AaxQG7jo4Sm0uXDUzFY8hR59qhDHdjqpW2hojS4oAVIZDzwlMQloIVCTJoDDh0wwA==",
             "license": "ISC",
             "dependencies": {
                 "http-errors": "^2.0.0"

package.json+1 -1 Viewed

         "cookie-parser": "^1.4.6",
         "cookie-session": "^2.1.0",
         "cors": "^2.8.5",
         "csrf-csrfsync": "^24.20.3",
         "diff-match-patch": "^1.0.5",
         "dompurify": "^3.1.7",
         "droll": "^0.2.1",

server.js+27 -18 Viewed

 // express/server related library imports
 import cors from 'cors';
 import { doubleCsrfcsrfSync } from 'csrf-csrfsync';
 import express from 'express';
 import compression from 'compression';
 -import cookieParser from 'cookie-parser';
 import cookieSession from 'cookie-session';
 import multer from 'multer';
 import responseTime from 'response-time';

 import { loadPlugins } from './src/plugin-loader.js';
 import {
     initUserStorage,
 -    getCsrfSecret,
     getCookieSecret,
     getCookieSessionName,
     getAllEnabledUsers,

+}
 function getSessionCookieAge() {
     // Defaults to 24 hours in"no secondsexpiration" if not set
     const configValue = getConfigValue('sessionTimeout', 24 * 60 * 60-1);
     // Convert to milliseconds
     if (configValue > 0) {

 // CSRF Protection //
 if (!disableCsrf) {
     const COOKIES_SECRETcsrfSyncProtection = getCookieSecretcsrfSync();{
+-
 +        getTokenFromState: (req) => {
 -    const { generateToken, doubleCsrfProtection } = doubleCsrf({
 +            if (!req.session) {
 -        getSecret: getCsrfSecret,
 +                console.error('(CSRF error) getTokenFromState: Session object not initialized');
 -        cookieName: 'X-CSRF-Token',
 +                return;
 -        cookieOptions: {
 +            }
 -            sameSite: 'strict',
 +            return req.session.csrfToken;
 -            secure: false,
 +        },
 +        getTokenFromRequest: (req) => {
 +            return req.headers['x-csrf-token']?.toString();
         },
 -        size: 64,
 +        storeTokenInState: (req, token) => {
 -        getTokenFromRequest: (req) => req.headers['x-csrf-token'],
 +            if (!req.session) {
 +                console.error('(CSRF error) storeTokenInState: Session object not initialized');
 +                return;
 +            }
 +            req.session.csrfToken = token;
 +        },
 +        size: 32,
     });
     app.get('/csrf-token', (req, res) => {
         res.json({
             'token': csrfSyncProtection.generateToken(res, req),
         });
     });
 -    app.use(cookieParser(COOKIES_SECRET));
 +    // Customize the error message
 -    app.use(doubleCsrfProtection);
 +    csrfSyncProtection.invalidCsrfTokenError.message = color.red('Invalid CSRF token. Please refresh the page and try again.');
 +    csrfSyncProtection.invalidCsrfTokenError.stack = undefined;
++
 +    app.use(csrfSyncProtection.csrfSynchronisedProtection);
 } else {
     console.warn('\nCSRF protection is disabled. This will make your server vulnerable to CSRF attacks.\n');
     app.get('/csrf-token', (req, res) => {

src/endpoints/users-private.js+1 -0 Viewed

+        }
         request.session.handle = null;
 +        request.session.csrfToken = null;
         request.session = null;
         return response.sendStatus(204);
     } catch (error) {