simple-next-csrf/dist/middlewares.js

This project aims to add Cross-Site Request Forgery (CSRF) protection to a Next.js application that does have server-side props support.

"use strict";
var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
    return new (P || (P = Promise))(function (resolve, reject) {
        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
        step((generator = generator.apply(thisArg, _arguments || [])).next());
    });
};
var __importDefault = (this && this.__importDefault) || function (mod) {
    return (mod && mod.__esModule) ? mod : { "default": mod };
};
Object.defineProperty(exports, "__esModule", { value: true });
exports.configureMiddleware = void 0;
const cookies_1 = __importDefault(require("cookies"));
const utils_1 = require("./utils");
const CSRF_TOKEN_NAME = "CSRF-TOKEN";
const getErrorReponse = () => ({
    error: "CSRF token missing",
});
const defaultSecureMethods = ["POST", "PATCH", "PUT"];
const configureMiddleware = (args) => {
    const { cookieOptions = {}, secret, secureMethods = defaultSecureMethods, } = args;
    const csrfEnjector = (getServerSideProps) => {
        return (context) => __awaiter(void 0, void 0, void 0, function* () {
            const { req, res } = context;
            const cookies = new cookies_1.default(req, res);
            const token = (0, utils_1.getToken)(secret);
            cookies.set(CSRF_TOKEN_NAME, token, cookieOptions);
            return getServerSideProps(context);
        });
    };
    const csrfValidator = (handler) => {
        return (request, response) => __awaiter(void 0, void 0, void 0, function* () {
            const method = request.method;
            const handle = () => {
                return handler(request, response);
            };
            if (!secureMethods.includes(method)) {
                yield handle();
                return;
            }
            const cookies = request.cookies;
            const token = cookies[CSRF_TOKEN_NAME];
            if (!token || !(0, utils_1.validateToken)(token, secret)) {
                return response.status(401).json(getErrorReponse());
            }
            yield handle();
        });
    };
    return {
        csrfEnjector,
        csrfValidator,
    };
};
exports.configureMiddleware = configureMiddleware;