61 lines
1.6 KiB
Plaintext
61 lines
1.6 KiB
Plaintext
include::../description.adoc[]
|
|
|
|
include::../ask-yourself.adoc[]
|
|
|
|
include::../recommended.adoc[]
|
|
|
|
== Sensitive Code Example
|
|
|
|
https://www.npmjs.com/package/csurf[Express.js CSURF middleware] protection is not found on an unsafe HTTP method like POST method:
|
|
|
|
----
|
|
let csrf = require('csurf');
|
|
let express = require('express');
|
|
|
|
let csrfProtection = csrf({ cookie: true });
|
|
|
|
let app = express();
|
|
|
|
// Sensitive: this operation doesn't look like protected by CSURF middleware (csrfProtection is not used)
|
|
app.post('/money_transfer', parseForm, function (req, res) {
|
|
res.send('Money transferred');
|
|
});
|
|
----
|
|
|
|
Protection provided by https://www.npmjs.com/package/csurf[Express.js CSURF middleware] is globally disabled on unsafe methods:
|
|
|
|
----
|
|
let csrf = require('csurf');
|
|
let express = require('express');
|
|
|
|
app.use(csrf({ cookie: true, ignoreMethods: ["POST", "GET"] })); // Sensitive as POST is unsafe method
|
|
----
|
|
|
|
== Compliant Solution
|
|
|
|
https://www.npmjs.com/package/csurf[Express.js CSURF middleware] protection is used on unsafe methods:
|
|
|
|
----
|
|
let csrf = require('csurf');
|
|
let express = require('express');
|
|
|
|
let csrfProtection = csrf({ cookie: true });
|
|
|
|
let app = express();
|
|
|
|
app.post('/money_transfer', parseForm, csrfProtection, function (req, res) { // Compliant
|
|
res.send('Money transferred')
|
|
});
|
|
----
|
|
|
|
Protection provided by https://www.npmjs.com/package/csurf[Express.js CSURF middleware] is enabled on unsafe methods:
|
|
|
|
----
|
|
let csrf = require('csurf');
|
|
let express = require('express');
|
|
|
|
app.use(csrf({ cookie: true, ignoreMethods: ["GET"] })); // Compliant
|
|
----
|
|
|
|
include::../see.adoc[]
|