csrf token

server/src/api/routes/index.js

@@ -8,10 +8,11 @@ import authRequired from '../../middleware/authRequired.js'
 import userRouter from './userRouter.js'
 import config from '../../config.js'
 import leaderboardController from '../controllers/leaderboardController.js'
-import csrfProtection from '../../middleware/csrfProtection.js'
+import lusca from 'lusca'
+import cookieParser from 'cookie-parser'
 
 const router = Router()
-
+router.use(cookieParser())
 if (!config.isProduction) {
   router.get('/', (req, res) => {
     res.send('Hello API!')
@@ -22,17 +23,27 @@ if (!config.isProduction) {
   })
 }
 
-router.use('/auth', authRouter)
-router.use('/quests', csrfProtection, quests)
-router.use('/users', csrfProtection, userRouter)
-
-router.use('/sessions', authRequired, sessions)
 router.use(
   '/commands',
   passport.authenticate('jwt', { session: false }),
   authRequired,
   commands
 )
+router.use('/auth', authRouter)
+router.use('/sessions', authRequired, sessions)
+router.use(
+  lusca({
+    csrf: {
+      cookie: { name: '_csrf' },
+      header: 'x-csrf-token',
+      secret: config.secret,
+    },
+    hsts: { maxAge: 31536000, includeSubDomains: true, preload: true },
+  })
+)
+
+router.use('/quests', quests)
+router.use('/users', userRouter)
 
 router.get('/survey', (req, res) => {
   if (!config.surveyUrl) {