fix: CSRF issue #51

server/package.json

@@ -19,6 +19,7 @@
     "bcrypt": "^5.1.1",
     "commander": "^11.0.0",
     "connect-mongo": "^5.0.0",
+    "csurf": "^1.11.0",
     "dockerode": "^3.3.5",
     "express": "^4.18.2",
     "express-rate-limit": "^7.1.3",

server/src/api/routes/index.js

@@ -8,7 +8,7 @@ import authRequired from '../../middleware/authRequired.js'
 import userRouter from './userRouter.js'
 import config from '../../config.js'
 import leaderboardController from '../controllers/leaderboardController.js'
-
+import csrfProtection from '../../middleware/csrfProtection.js'
 const router = Router()
 
 if (!config.isProduction) {
@@ -22,8 +22,8 @@ if (!config.isProduction) {
 }
 
 router.use('/auth', authRouter)
-router.use('/quests', quests)
-router.use('/users', userRouter)
+router.use('/quests', csrfProtection, quests)
+router.use('/users', csrfProtection, userRouter)
 
 router.use('/sessions', authRequired, sessions)
 router.use(