Improved CSRF handling

src/controllers/api/refreshCSRFTokenController.js

@@ -0,0 +1,31 @@
+/*Canopy - The next generation of stoner streaming software
+Copyright (C) 2024-2025 Rainbownapkin and the TTN Community
+
+This program is free software: you can redistribute it and/or modify
+it under the terms of the GNU Affero General Public License as
+published by the Free Software Foundation, either version 3 of the
+License, or (at your option) any later version.
+
+This program is distributed in the hope that it will be useful,
+but WITHOUT ANY WARRANTY; without even the implied warranty of
+MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+GNU Affero General Public License for more details.
+
+You should have received a copy of the GNU Affero General Public License
+along with this program.  If not, see <https://www.gnu.org/licenses/>.*/
+
+//local imports
+const {exceptionHandler, errorHandler} = require('../../utils/loggerUtils');
+const csrfUtils = require('../../utils/csrfUtils');
+
+//api account functions
+module.exports.get = async function(req, res){
+    try{
+        //Set status to 200
+        res.status(200);
+        //Generate and send token based on the request
+        res.send({token: csrfUtils.generateToken(req)});
+    }catch(err){
+        return exceptionHandler(res, err);
+    }
+}

src/routers/apiRouter.js

@@ -18,14 +18,19 @@ along with this program.  If not, see <https://www.gnu.org/licenses/>.*/
 const { Router } = require('express');
 
 //local imports
+const csrfUtil = require('../utils/csrfUtils');
 const accountRouter = require("./api/accountRouter");
 const channelRouter = require("./api/channelRouter");
 const adminRouter = require("./api/adminRouter");
-const csrfUtil = require('../utils/csrfUtils');
+const refreshCSRFTokenController = require("../controllers/api/refreshCSRFTokenController");
 
 //globals
 const router = Router();
 
+
+//CSRF token request controller
+router.get('/refreshToken', refreshCSRFTokenController.get);
+
 //Apply Cross-Site Request Forgery protection to API calls
 router.use(csrfUtil.csrfSynchronisedProtection);