Skip to content

AUT-4272: migrate from csurf to csurf sync (v2) #2804

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
sw-mattw wants to merge 7 commits into from
Closed

AUT-4272: migrate from csurf to csurf sync (v2) #2804

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
7 commits
Select commit Hold shift + click to select a range
434f32a
AUT-4272: Add csurf-sync package
sw-mattw May 19, 2025
51c493e
AUT-4272: Migrate to use csrf-sync (new token per request)
sw-mattw May 19, 2025
92615af
AUT-4272: Remove redundant cookie options
sw-mattw May 19, 2025
9d3905f
AUT-4272: Remove csurf package and types
sw-mattw May 19, 2025
e966bb6
AUT-4272: Switch to use a single csrf token per session
sw-mattw May 19, 2025
9747a66
AUT-4272: render error pages upon CSRF error
sw-mattw May 27, 2025
3e87792
AUT-4272: update csrf snapshots now "internal server error" page is r…
sw-mattw May 28, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
3 changes: 1 addition & 2 deletions package.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -79,7 +79,7 @@
"connect-redis": "8.0.3",
"cookie-parser": "1.4.7",
"copyfiles": "2.4.1",
"csurf": "1.11.0",
"csrf-sync": "4.2.1",
"dompurify": "3.2.5",
"ecdsa-sig-formatter": "1.0.11",
"express": "4.21.2",
Expand Down Expand Up @@ -112,7 +112,6 @@
"@types/chai": "4.3.0",
"@types/cheerio": "0.22.35",
"@types/cookie-parser": "1.4.8",
"@types/csurf": "1.11.5",
"@types/debug": "4.1.12",
"@types/express": "4.17.21",
"@types/express-session": "1.18.1",
Expand Down
2 changes: 2 additions & 0 deletions src/app.constants.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -139,6 +139,8 @@ export const ERROR_MESSAGES = {
PAGE_NOT_FOUND: "Request page not found",
};

export const CSRF_MISSING_CODE = "EBADCSRFTOKEN";

export const ERROR_LOG_LEVEL = {
ERROR: "Error",
INFO: "Info",
Expand Down
6 changes: 3 additions & 3 deletions src/app.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2,7 +2,6 @@ import type { Application } from "express";
import express from "express";
import "express-async-errors";
import cookieParser from "cookie-parser";
import csurf from "csurf";
import type serveStatic from "serve-static";
import { logger, loggerMiddleware } from "./utils/logger.js";
import { sanitizeRequestMiddleware } from "./middleware/sanitize-request-middleware.js";
Expand Down Expand Up @@ -40,7 +39,6 @@ import { serverErrorHandler } from "./handlers/internal-server-error-handler.js"
import { csrfMiddleware } from "./middleware/csrf-middleware.js";
import { checkYourPhoneRouter } from "./components/check-your-phone/check-your-phone-routes.js";
import { landingRouter } from "./components/landing/landing-route.js";
import { getCSRFCookieOptions } from "./config/cookie.js";
import { ENVIRONMENT_NAME } from "./app.constants.js";
import { enterMfaRouter } from "./components/enter-mfa/enter-mfa-routes.js";
import { howDoYouWantSecurityCodesRouter } from "./components/how-do-you-want-security-codes/how-do-you-want-security-codes-routes.js";
Expand Down Expand Up @@ -103,6 +101,7 @@ import { environmentBannerMiddleware } from "./middleware/environment-banner-mid
import UID from "uid-safe";
import { fileURLToPath } from "node:url";
import { dirname } from "node:path";
import { csrfSynchronisedProtection } from "./utils/csrf.js";

const directory_name = dirname(fileURLToPath(import.meta.url));

Expand Down Expand Up @@ -246,7 +245,8 @@ async function createApp(): Promise<express.Application> {
})
);

app.use(csurf({ cookie: getCSRFCookieOptions(isProduction) }));
// Must be added to the app after the session and logging, and before the routers.
app.use(csrfSynchronisedProtection);

app.use(channelMiddleware);
app.use(environmentBannerMiddleware);
Expand Down
12 changes: 6 additions & 6 deletions ...unt-creation/resend-mfa-code/tests/__snapshots__/resend-mfa-code-integration.test.ts.snap
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -13,12 +13,12 @@ Object {

exports[`Integration:: resend SMS mfa code (account creation variant) should return error when csrf not present 1`] = `
Object {
"contentId": undefined,
"taxonomyLevel1": undefined,
"taxonomyLevel2": undefined,
"taxonomyLevel3": undefined,
"taxonomyLevel4": undefined,
"taxonomyLevel5": undefined,
"contentId": "",
"taxonomyLevel1": "",
"taxonomyLevel2": "",
"taxonomyLevel3": "",
"taxonomyLevel4": "",
"taxonomyLevel5": "",
}
`;

Expand Down
12 changes: 6 additions & 6 deletions ...components/check-your-email/tests/__snapshots__/check-your-email-integration.test.ts.snap
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -13,12 +13,12 @@ Object {

exports[`Integration:: check your email should return error when csrf not present 1`] = `
Object {
"contentId": undefined,
"taxonomyLevel1": undefined,
"taxonomyLevel2": undefined,
"taxonomyLevel3": undefined,
"taxonomyLevel4": undefined,
"taxonomyLevel5": undefined,
"contentId": "",
"taxonomyLevel1": "",
"taxonomyLevel2": "",
"taxonomyLevel3": "",
"taxonomyLevel4": "",
"taxonomyLevel5": "",
}
`;

Expand Down
12 changes: 6 additions & 6 deletions ...components/check-your-phone/tests/__snapshots__/check-your-phone-integration.test.ts.snap
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -35,12 +35,12 @@ Object {

exports[`Integration:: check your phone should return error when csrf not present 1`] = `
Object {
"contentId": undefined,
"taxonomyLevel1": undefined,
"taxonomyLevel2": undefined,
"taxonomyLevel3": undefined,
"taxonomyLevel4": undefined,
"taxonomyLevel5": undefined,
"contentId": "",
"taxonomyLevel1": "",
"taxonomyLevel2": "",
"taxonomyLevel3": "",
"taxonomyLevel4": "",
"taxonomyLevel5": "",
}
`;

Expand Down
12 changes: 6 additions & 6 deletions src/components/contact-us/tests/__snapshots__/contact-us-controller-integration.test.ts.snap
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -266,12 +266,12 @@ Object {

exports[`Integration:: contact us - public user should return error when csrf not present 1`] = `
Object {
"contentId": undefined,
"taxonomyLevel1": undefined,
"taxonomyLevel2": undefined,
"taxonomyLevel3": undefined,
"taxonomyLevel4": undefined,
"taxonomyLevel5": undefined,
"contentId": "",
"taxonomyLevel1": "",
"taxonomyLevel2": "",
"taxonomyLevel3": "",
"taxonomyLevel4": "",
"taxonomyLevel5": "",
}
`;

Expand Down
12 changes: 6 additions & 6 deletions src/components/create-password/tests/__snapshots__/create-password-integration.test.ts.snap
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -13,12 +13,12 @@ Object {

exports[`Integration::register create password should return error when csrf not present 1`] = `
Object {
"contentId": undefined,
"taxonomyLevel1": undefined,
"taxonomyLevel2": undefined,
"taxonomyLevel3": undefined,
"taxonomyLevel4": undefined,
"taxonomyLevel5": undefined,
"contentId": "",
"taxonomyLevel1": "",
"taxonomyLevel2": "",
"taxonomyLevel3": "",
"taxonomyLevel4": "",
"taxonomyLevel5": "",
}
`;

Expand Down
23 changes: 6 additions & 17 deletions ...icator-app-code/tests/__snapshots__/enter-authenticator-app-code-integration.test.ts.snap
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -11,17 +11,6 @@ Object {
}
`;

exports[`Integration:: enter authenticator app code should display correct link to reset mfa 1`] = `
Object {
"contentId": "89461417-df3f-46a8-9c37-713b9dd78085",
"taxonomyLevel1": "authentication",
"taxonomyLevel2": "sign in",
"taxonomyLevel3": "",
"taxonomyLevel4": "",
"taxonomyLevel5": "",
}
`;

exports[`Integration:: enter authenticator app code should include the correct link to change/reset mfa methods when the user has 1 mfaMethods 1`] = `
Object {
"contentId": "89461417-df3f-46a8-9c37-713b9dd78085",
Expand Down Expand Up @@ -79,12 +68,12 @@ Object {

exports[`Integration:: enter authenticator app code should return error when csrf not present 1`] = `
Object {
"contentId": undefined,
"taxonomyLevel1": undefined,
"taxonomyLevel2": undefined,
"taxonomyLevel3": undefined,
"taxonomyLevel4": undefined,
"taxonomyLevel5": undefined,
"contentId": "",
"taxonomyLevel1": "",
"taxonomyLevel2": "",
"taxonomyLevel3": "",
"taxonomyLevel4": "",
"taxonomyLevel5": "",
}
`;

Expand Down
12 changes: 6 additions & 6 deletions ...nents/enter-email/tests/__snapshots__/enter-email-create-account-integration.test.ts.snap
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -24,12 +24,12 @@ Object {

exports[`Integration::enter email (create account) should return error when csrf not present 1`] = `
Object {
"contentId": undefined,
"taxonomyLevel1": undefined,
"taxonomyLevel2": undefined,
"taxonomyLevel3": undefined,
"taxonomyLevel4": undefined,
"taxonomyLevel5": undefined,
"contentId": "",
"taxonomyLevel1": "",
"taxonomyLevel2": "",
"taxonomyLevel3": "",
"taxonomyLevel4": "",
"taxonomyLevel5": "",
}
`;

Expand Down
12 changes: 6 additions & 6 deletions src/components/enter-email/tests/__snapshots__/enter-email-integration.test.ts.snap
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -24,12 +24,12 @@ Object {

exports[`Integration::enter email should return error when csrf not present 1`] = `
Object {
"contentId": undefined,
"taxonomyLevel1": undefined,
"taxonomyLevel2": undefined,
"taxonomyLevel3": undefined,
"taxonomyLevel4": undefined,
"taxonomyLevel5": undefined,
"contentId": "",
"taxonomyLevel1": "",
"taxonomyLevel2": "",
"taxonomyLevel3": "",
"taxonomyLevel4": "",
"taxonomyLevel5": "",
}
`;

Expand Down
23 changes: 6 additions & 17 deletions src/components/enter-mfa/tests/__snapshots__/enter-mfa-integration.test.ts.snap
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -11,17 +11,6 @@ Object {
}
`;

exports[`Integration:: enter mfa should include the correct link to change mfa methods 1`] = `
Object {
"contentId": "19601dd7-be55-4ab6-aa44-a6358c4239dc",
"taxonomyLevel1": "authentication",
"taxonomyLevel2": "sign in",
"taxonomyLevel3": "",
"taxonomyLevel4": "",
"taxonomyLevel5": "",
}
`;

exports[`Integration:: enter mfa should include the correct link to change mfa methods when the user has 1 mfaMethods 1`] = `
Object {
"contentId": "19601dd7-be55-4ab6-aa44-a6358c4239dc",
Expand Down Expand Up @@ -68,12 +57,12 @@ Object {

exports[`Integration:: enter mfa should return error when csrf not present 1`] = `
Object {
"contentId": undefined,
"taxonomyLevel1": undefined,
"taxonomyLevel2": undefined,
"taxonomyLevel3": undefined,
"taxonomyLevel4": undefined,
"taxonomyLevel5": undefined,
"contentId": "",
"taxonomyLevel1": "",
"taxonomyLevel2": "",
"taxonomyLevel3": "",
"taxonomyLevel4": "",
"taxonomyLevel5": "",
}
`;

Expand Down
12 changes: 6 additions & 6 deletions src/components/enter-password/tests/__snapshots__/enter-password-integration.test.ts.snap
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -13,12 +13,12 @@ Object {

exports[`Integration::enter password should return error when csrf not present 1`] = `
Object {
"contentId": undefined,
"taxonomyLevel1": undefined,
"taxonomyLevel2": undefined,
"taxonomyLevel3": undefined,
"taxonomyLevel4": undefined,
"taxonomyLevel5": undefined,
"contentId": "",
"taxonomyLevel1": "",
"taxonomyLevel2": "",
"taxonomyLevel3": "",
"taxonomyLevel4": "",
"taxonomyLevel5": "",
}
`;

Expand Down
12 changes: 6 additions & 6 deletions ...ponents/enter-password/tests/__snapshots__/enter-password-reauth-integration.test.ts.snap
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -13,12 +13,12 @@ Object {

exports[`Integration::enter password should return error when csrf not present 1`] = `
Object {
"contentId": undefined,
"taxonomyLevel1": undefined,
"taxonomyLevel2": undefined,
"taxonomyLevel3": undefined,
"taxonomyLevel4": undefined,
"taxonomyLevel5": undefined,
"contentId": "",
"taxonomyLevel1": "",
"taxonomyLevel2": "",
"taxonomyLevel3": "",
"taxonomyLevel4": "",
"taxonomyLevel5": "",
}
`;

Expand Down
12 changes: 6 additions & 6 deletions ...onents/enter-phone-number/tests/__snapshots__/enter-phone-number-integration.test.ts.snap
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -24,12 +24,12 @@ Object {

exports[`Integration::enter phone number should return error when csrf not present 1`] = `
Object {
"contentId": undefined,
"taxonomyLevel1": undefined,
"taxonomyLevel2": undefined,
"taxonomyLevel3": undefined,
"taxonomyLevel4": undefined,
"taxonomyLevel5": undefined,
"contentId": "",
"taxonomyLevel1": "",
"taxonomyLevel2": "",
"taxonomyLevel3": "",
"taxonomyLevel4": "",
"taxonomyLevel5": "",
}
`;

Expand Down
55 changes: 0 additions & 55 deletions ...ecurity-codes/tests/__snapshots__/how-do-you-want-security-codes-integration.test.ts.snap
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,60 +1,5 @@
// Jest Snapshot v1, https://goo.gl/fbAQLP

exports[`Integration::how do you want security codes should include link to reset mfa methods 1`] = `
Object {
"contentId": "",
"taxonomyLevel1": "authentication",
"taxonomyLevel2": "",
"taxonomyLevel3": "",
"taxonomyLevel4": "",
"taxonomyLevel5": "",
}
`;

exports[`Integration::how do you want security codes should return how do you want security codes page 1`] = `
Object {
"contentId": "",
"taxonomyLevel1": "authentication",
"taxonomyLevel2": "",
"taxonomyLevel3": "",
"taxonomyLevel4": "",
"taxonomyLevel5": "",
}
`;

exports[`Integration::how do you want security codes should return how do you want security codes page as expected 1`] = `
Object {
"contentId": "",
"taxonomyLevel1": "authentication",
"taxonomyLevel2": "",
"taxonomyLevel3": "",
"taxonomyLevel4": "",
"taxonomyLevel5": "",
}
`;

exports[`Integration::how do you want security codes should return how do you want security codes page as expected for SMS user with AUTH APP backup 1`] = `
Object {
"contentId": "",
"taxonomyLevel1": "authentication",
"taxonomyLevel2": "",
"taxonomyLevel3": "",
"taxonomyLevel4": "",
"taxonomyLevel5": "",
}
`;

exports[`Integration::how do you want security codes should return how do you want security codes page as expected for SMS user with SMS backup 1`] = `
Object {
"contentId": "",
"taxonomyLevel1": "authentication",
"taxonomyLevel2": "",
"taxonomyLevel3": "",
"taxonomyLevel4": "",
"taxonomyLevel5": "",
}
`;

exports[`Integration::how do you want security codes should return page as expected for AUTH APP user with SMS backup 1`] = `
Object {
"contentId": "",
Expand Down
Loading
Loading