lxe/workflow-app
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Rework CSRF: deterministic token from session + self-healing cookie (no more stale 403s)

Browse Source
This commit is contained in:
Kühn
2026-08-31 11:26:00 +02:00
parent a05133f39d
commit ec2ed91621
3 changed files with 57 additions and 15 deletions
Download Patch File Download Diff File Expand all files Collapse all files

11
backend/routes/auth.js
View File

@@ -9,7 +9,7 @@ const express = require('express');
const bcrypt = require('bcryptjs');
const db = require('../db');
const { auditLog } = require('../auditLog');
const { authMiddleware, adminMiddleware, createSession, deleteSession, invalidateUserSessions, isAccountLocked, recordFailedLogin, recordSuccessfulLogin, setAuthCookie, clearAuthCookie, setCSRFCookie } = require('../middleware/auth');
const { authMiddleware, adminMiddleware, createSession, deleteSession, invalidateUserSessions, isAccountLocked, recordFailedLogin, recordSuccessfulLogin, setAuthCookie, clearAuthCookie, setCSRFCookie, hashToken } = require('../middleware/auth');
const { isLDAPConfigured, authenticateLDAP } = require('../ldapSync');
const { loginLimiter } = require('../middleware/rateLimit');
const { validate, registerSchema, loginSchema } = require('../middleware/validation');
@@ -61,7 +61,8 @@ router.post('/login', loginLimiter, validate(loginSchema), async (req, res) => {
const oldToken = req.cookies?.workflow_token || req.headers.authorization?.replace('Bearer ', '');
const rawToken = await createSession(adRow.id, oldToken);
setAuthCookie(res, rawToken); // Punkt 8: HttpOnly-Cookie
const csrfToken = setCSRFCookie(res); // P4: CSRF cookie
// P4: CSRF cookie derived from the new session token (deterministic, self-healing)
const csrfToken = setCSRFCookie(res, hashToken(rawToken));
auditLog(adRow.id, 'login', 'user', adRow.id, 'AD login');
// Bug 6: Don't expose token in response body (cookie-only auth)
res.json({ ...adRow, csrfToken });
@@ -89,7 +90,8 @@ router.post('/login', loginLimiter, validate(loginSchema), async (req, res) => {
const oldTokenAD = req.cookies?.workflow_token || req.headers.authorization?.replace('Bearer ', '');
const rawToken = await createSession(row.id, oldTokenAD);
setAuthCookie(res, rawToken); // Punkt 8: HttpOnly-Cookie
const csrfToken = setCSRFCookie(res); // P4: CSRF cookie
// P4: CSRF cookie derived from the new session token (deterministic, self-healing)
const csrfToken = setCSRFCookie(res, hashToken(rawToken));
auditLog(row.id, 'login', 'user', row.id, 'AD login');
const { password: _, ...safeRow } = row;
// Bug 6: Don't expose token in response body (cookie-only auth)
@@ -123,7 +125,8 @@ router.post('/login', loginLimiter, validate(loginSchema), async (req, res) => {
const oldTokenLocal = req.cookies?.workflow_token || req.headers.authorization?.replace('Bearer ', '');
const rawToken = await createSession(row.id, oldTokenLocal);
setAuthCookie(res, rawToken); // Punkt 8: HttpOnly-Cookie
const csrfToken = setCSRFCookie(res); // P4: CSRF cookie
// P4: CSRF cookie derived from the new session token (deterministic, self-healing)
const csrfToken = setCSRFCookie(res, hashToken(rawToken));
auditLog(row.id, 'login', 'user', row.id, 'Local login');
const { password: _, ...safeRow } = row;
// Bug 6: Don't expose token in response body (cookie-only auth)