nestjs-mvc-tools/dist/lib/middlewares/nest-mvc-csrf.middleware.js

NestJS MVC Tools is a small set of tools designed to help you get started more easily with traditional web development approaches in NestJS.

"use strict";
var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
    return c > 3 && r && Object.defineProperty(target, key, r), r;
};
var __metadata = (this && this.__metadata) || function (k, v) {
    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
};
Object.defineProperty(exports, "__esModule", { value: true });
exports.NestMvcCsrfMiddleware = void 0;
const common_1 = require("@nestjs/common");
const nest_mvc_csrf_service_1 = require("../services/nest-mvc-csrf.service");
const nest_mvc_logger_service_1 = require("../services/nest-mvc-logger.service");
const nest_mvc_options_service_1 = require("../services/nest-mvc-options.service");
let NestMvcCsrfMiddleware = class NestMvcCsrfMiddleware {
    constructor(csrfService, optionsService, logger) {
        this.csrfService = csrfService;
        this.optionsService = optionsService;
        this.logger = logger;
        this.options = this.optionsService.csrfOptions;
    }
    use(req, res, next) {
        // 제외 경로 체크
        if (this.optionsService.excludePaths.some((path) => req.originalUrl.startsWith(path))) {
            return next();
        }
        // CSRF 기능 비활성화시 통과
        if (!this.options.enabled) {
            this.logger.debug("Disabled NestMvcCsrf");
            return next();
        }
        this.logger.debug("Enabled NestMvcCsrf");
        // early return: 세션이 없으면 바로 반환
        if (!req?.session) {
            this.logger.warn(`
      Session not active. Please configure sessions to use CSRF functionality.
      https://github.com/dev-goraebap/nestjs-mvc-tools/blob/develop/docs/CONFIGURATION.md#important-session-dependencies
      `);
            return next();
        }
        // 세션에 secret이 없으면 생성
        if (!req.session.csrfSecret) {
            req.session.csrfSecret = this.csrfService.generateSecret();
        }
        // 뷰가 있는 경우 템플릿에 토큰 전달 (모든 요청에서 공통)
        if (req.view) {
            req.view.share({
                csrfToken: this.csrfService.generateToken(req.session.csrfSecret),
            });
        }
        // early return: 무시할 메서드는 검증하지 않음
        const { ignoredMethods } = this.optionsService.csrfOptions;
        if (ignoredMethods.includes(req.method)) {
            return next();
        }
        // 토큰 검증 (secret 존재 확인 후 토큰 추출)
        const token = this.extractTokenFromRequest(req);
        if (!token ||
            !this.csrfService.verifyToken(req.session.csrfSecret, token)) {
            next(new common_1.ForbiddenException("Invalid CSRF token"));
        }
        next();
    }
    // 다양한 위치에서 토큰 추출
    extractTokenFromRequest(req) {
        return (req.headers["x-csrf-token"] || req.body?._csrf || req.query?._csrf || null);
    }
};
exports.NestMvcCsrfMiddleware = NestMvcCsrfMiddleware;
exports.NestMvcCsrfMiddleware = NestMvcCsrfMiddleware = __decorate([
    (0, common_1.Injectable)(),
    __metadata("design:paramtypes", [nest_mvc_csrf_service_1.NestMvcCsrfService,
        nest_mvc_options_service_1.NestMvcOptionsService,
        nest_mvc_logger_service_1.NestMvcLoggerService])
], NestMvcCsrfMiddleware);