csrf token

server/package.json

@@ -19,13 +19,14 @@
     "bcrypt": "^5.1.1",
     "commander": "^11.0.0",
     "connect-mongo": "^5.0.0",
-    "csurf": "^1.11.0",
+    "cookie-parser": "^1.4.6",
     "dockerode": "^3.3.5",
     "express": "^4.18.2",
     "express-rate-limit": "^7.1.3",
     "express-session": "^1.17.3",
     "express-validator": "^7.0.1",
     "jsonwebtoken": "^9.0.1",
+    "lusca": "^1.7.0",
     "minimist": "^1.2.8",
     "mongoose": "^8.0.3",
     "node-schedule": "^2.1.1",

server/src/api/routes/index.js

@@ -8,10 +8,11 @@ import authRequired from '../../middleware/authRequired.js'
 import userRouter from './userRouter.js'
 import config from '../../config.js'
 import leaderboardController from '../controllers/leaderboardController.js'
-import csrfProtection from '../../middleware/csrfProtection.js'
+import lusca from 'lusca'
+import cookieParser from 'cookie-parser'
 
 const router = Router()
-
+router.use(cookieParser())
 if (!config.isProduction) {
   router.get('/', (req, res) => {
     res.send('Hello API!')
@@ -22,17 +23,27 @@ if (!config.isProduction) {
   })
 }
 
-router.use('/auth', authRouter)
-router.use('/quests', csrfProtection, quests)
-router.use('/users', csrfProtection, userRouter)
-
-router.use('/sessions', authRequired, sessions)
 router.use(
   '/commands',
   passport.authenticate('jwt', { session: false }),
   authRequired,
   commands
 )
+router.use('/auth', authRouter)
+router.use('/sessions', authRequired, sessions)
+router.use(
+  lusca({
+    csrf: {
+      cookie: { name: '_csrf' },
+      header: 'x-csrf-token',
+      secret: config.secret,
+    },
+    hsts: { maxAge: 31536000, includeSubDomains: true, preload: true },
+  })
+)
+
+router.use('/quests', quests)
+router.use('/users', userRouter)
 
 router.get('/survey', (req, res) => {
   if (!config.surveyUrl) {

server/src/middleware/csrfProtection.js

@@ -1,12 +0,0 @@
-import csrf from 'csurf'
-
-const CSRF = csrf({ cookie: true })
-function csrfProtection(req, res, next) {
-  if (req.method === 'POST') {
-    CSRF(req, res, next)
-  } else {
-    next()
-  }
-}
-
-export default csrfProtection