rainbownapkin/canopy
1
0
Fork 0
Code Issues 5 Pull requests Projects Releases Packages Wiki Activity Actions

Added CSRF protection to all API calls. /api/account AJAX calls updated.

Browse source
This commit is contained in:
rainbow napkin 2024-12-29 21:40:50 -05:00
parent 7e0c8e72c5
commit 106b0fcddb
11 changed files with 149 additions and 14 deletions
Download patch file Download diff file Expand all files Collapse all files

2
src/routers/api/accountRouter.js
View file

@ -35,7 +35,7 @@ const router = Router();
//login
router.post('/login', accountValidator.user(), accountValidator.pass(), loginController.post);
//logout
router.get('/logout', logoutController.get);
router.post('/logout', logoutController.post);
//register
router.post('/register', accountValidator.user(),
accountValidator.securePass(),

4
src/routers/apiRouter.js
View file

@ -21,10 +21,14 @@ const { Router } = require('express');
const accountRouter = require("./api/accountRouter");
const channelRouter = require("./api/channelRouter");
const adminRouter = require("./api/adminRouter");
const csrfUtil = require('../utils/csrfUtils');
//globals
const router = Router();
//Apply Cross-Site Request Forgery protection to API calls
router.use(csrfUtil.csrfSynchronisedProtection);
//routing functions
router.use('/account', accountRouter);
router.use('/channel', channelRouter);