Use the configured secret when signing and verifying CSRF tokens

src/server/csrf.test.ts

@@ -131,6 +131,21 @@ describe("CSRF", () => {
 		);
 	});
 
+	test("rejects CSRF tokens signed with a different secret", async () => {
+		let token = new CSRF({ cookie, secret: "my-secret" }).generate();
+
+		let formData = new FormData();
+		formData.set("csrf", token);
+
+		let headers = new Headers({
+			cookie: await cookie.serialize(token),
+		});
+
+		expect(
+			new CSRF({ cookie, secret: "different-secret" }).validate(formData, headers),
+		).rejects.toThrow(new CSRFError("tampered_token_in_cookie", "Tampered CSRF token in cookie."));
+	});
+
 	test("commits the token to a cookie", async () => {
 		let [token, cookieHeader] = await csrf.commitToken();
 		let parsedCookie = await cookie.parse(cookieHeader);

src/server/csrf.ts

@@ -173,12 +173,24 @@
  * @author [Sergio Xalambrí](https://sergiodxa.com)
  * @module Server/CSRF
  */
-import { sha256 } from "@oslojs/crypto/sha2";
+import { hmac } from "@oslojs/crypto/hmac";
+import { SHA256 } from "@oslojs/crypto/sha2";
 import { encodeBase64url } from "@oslojs/encoding";
 import type { Cookie } from "react-router";
 import { randomString } from "../common/crypto.js";
 import { getHeaders } from "./get-headers.js";
 
+function timingSafeEqual(a: string, b: string) {
+	let mismatch = a.length ^ b.length;
+	let maxLength = Math.max(a.length, b.length);
+
+	for (let index = 0; index < maxLength; index++) {
+		mismatch |= (a.charCodeAt(index) || 0) ^ (b.charCodeAt(index) || 0);
+	}
+
+	return mismatch === 0;
+}
+
 export type CSRFErrorCode =
 	| "missing_token_in_cookie"
 	| "invalid_token_in_cookie"
@@ -343,14 +355,15 @@ export class CSRF {
 
 	private sign(token: string) {
 		if (!this.secret) return token;
-		return encodeBase64url(sha256(new TextEncoder().encode(token)));
+		let encoder = new TextEncoder();
+		return encodeBase64url(hmac(SHA256, encoder.encode(this.secret), encoder.encode(token)));
 	}
 
 	private verifySignature(token: string) {
 		if (!this.secret) return true;
 		let [value, signature] = token.split(".");
-		if (!value) return false;
+		if (!value || !signature) return false;
 		let expectedSignature = this.sign(value);
-		return signature === expectedSignature;
+		return timingSafeEqual(signature, expectedSignature);
 	}
 }