Merge remote-tracking branch 'origin/main' into renovate/csrf-csrf-4.x

apps/server/package.json

@@ -54,7 +54,7 @@
     "cls-hooked": "4.2.2",
     "compression": "1.8.1",
     "cookie-parser": "1.4.7",
-    "csrf-csrf": "3.2.2",
+    "csrf-csrf": "4.0.2",
     "dayjs": "1.11.13",
     "debounce": "2.2.0",
     "debug": "4.4.1",

apps/server/src/routes/csrf_protection.ts

@@ -2,6 +2,8 @@ import { doubleCsrf } from "csrf-csrf";
 import sessionSecret from "../services/session_secret.js";
 import { isElectron } from "../services/utils.js";
 
+export const CSRF_COOKIE_NAME = "trilium-csrf";
+
 const doubleCsrfUtilities = doubleCsrf({
     getSecret: () => sessionSecret,
     cookieOptions: {
@@ -10,7 +12,8 @@ const doubleCsrfUtilities = doubleCsrf({
         sameSite: "strict",
         httpOnly: !isElectron // set to false for Electron, see https://github.com/TriliumNext/Trilium/pull/966
     },
-    cookieName: "_csrf"
+    cookieName: CSRF_COOKIE_NAME,
+    getSessionIdentifier: (req) => req.session.id
 });
 
-export const { generateToken, doubleCsrfProtection } = doubleCsrfUtilities;
+export const { generateCsrfToken, doubleCsrfProtection } = doubleCsrfUtilities;

apps/server/src/routes/error_handlers.ts

@@ -3,6 +3,7 @@ import log from "../services/log.js";
 import NotFoundError from "../errors/not_found_error.js";
 import ForbiddenError from "../errors/forbidden_error.js";
 import HttpError from "../errors/http_error.js";
+import { CSRF_COOKIE_NAME } from "./csrf_protection.js";
 
 function register(app: Application) {
 
@@ -14,7 +15,7 @@ function register(app: Application) {
             && err.code === "EBADCSRFTOKEN";
 
         if (isCsrfTokenError) {
-            log.error(`Invalid CSRF token: ${req.headers["x-csrf-token"]}, secret: ${req.cookies["_csrf"]}`);
+            log.error(`Invalid CSRF token: ${req.headers["x-csrf-token"]}, secret: ${req.cookies[CSRF_COOKIE_NAME]}`);
             return next(new ForbiddenError("Invalid CSRF token"));
         }
 

apps/server/src/routes/index.ts

@@ -10,7 +10,7 @@ import protectedSessionService from "../services/protected_session.js";
 import packageJson from "../../package.json" with { type: "json" };
 import assetPath from "../services/asset_path.js";
 import appPath from "../services/app_path.js";
-import { generateToken as generateCsrfToken } from "./csrf_protection.js";
+import { generateCsrfToken } from "./csrf_protection.js";
 
 import type { Request, Response } from "express";
 import type BNote from "../becca/entities/bnote.js";
@@ -19,9 +19,10 @@ function index(req: Request, res: Response) {
     const options = optionService.getOptionMap();
     const view = getView(req);
 
-    //'overwrite' set to false (default) => the existing token will be re-used and validated
+    const csrfToken = generateCsrfToken(req, res, {
-    //'validateOnReuse' set to false => if validation fails, generate a new token instead of throwing an error
+        overwrite: false,
-    const csrfToken = generateCsrfToken(req, res, false, false);
+        validateOnReuse: false      // if validation fails, generate a new token instead of throwing an error
+    });
     log.info(`CSRF token generation: ${csrfToken ? "Successful" : "Failed"}`);
 
     // We force the page to not be cached since on mobile the CSRF token can be

pnpm-lock.yaml

@@ -625,8 +625,8 @@ importers:
         specifier: 1.4.7
         version: 1.4.7
       csrf-csrf:
-        specifier: 3.2.2
+        specifier: 4.0.2
-        version: 3.2.2
+        version: 4.0.2
       dayjs:
         specifier: 1.11.13
         version: 1.11.13
@@ -7467,8 +7467,8 @@ packages:
     resolution: {integrity: sha512-n63i0lZ0rvQ6FXiGQ+/JFCKAUyPFhLQYJIqKaa+tSJtfKeULF/IDNDAbdnSIxgS4NTuw2b0+lj8LzfITuq+ZxQ==}
     engines: {node: '>=12.10'}
 
-  csrf-csrf@3.2.2:
+  csrf-csrf@4.0.2:
-    resolution: {integrity: sha512-E3TgLWX1e+jqigDva+nFItfqa59UZ+gLR56DVNyL/xawBGwQr8o3U4/o1gP9FZmIWLnWCiIl5ni85MghMCNRfg==}
+    resolution: {integrity: sha512-jWI4uDjZn1EedVSa6WhiL6L6M5XmSemXLgCDGwrdPLtkCThSDDTj4ewokTTqrW8JZYcfJ3oY4LFCtXgQ2XAg5Q==}
 
   css-declaration-sorter@6.4.1:
     resolution: {integrity: sha512-rtdthzxKuyq6IzqX6jEcIzQF/YqccluefyCYheovBOLhFT/drQA9zj/UbRAa9J7C0o6EG6u3E6g+vKkay7/k3g==}
@@ -23855,7 +23855,7 @@ snapshots:
 
   cross-zip@4.0.1: {}
 
-  csrf-csrf@3.2.2:
+  csrf-csrf@4.0.2:
     dependencies:
       http-errors: 2.0.0