Comments (9)
It is as following
head
meta(name='csrf-token', content=_csrf)
body
form
input(type='hidden', name='_csrf', value=_csrf)
(Generated as expected)
from lusca.
Sorry, my bad. I was wrong.
from lusca.
No problem.
It looks like lusca does not support angular and there is already an open issue
#27
from lusca.
Correct -- you can make it work but it'll be manually, not using Angular's support for this. You'll need to propagate the _csrf
value from the res.locals
to the frontend and back.
from lusca.
@aredridel Please provide an example to do this in frontend and back. That would be really helpful for me!
from lusca.
I've created a sample project at https://github.com/aredridel/luscangular that uses lusca and angular with a trivial middleware to relay the res.locals._csrf
into the cookie that Angular expects.
The commit history should provide a reasonable how-to.
from lusca.
First of all i appreciate the good work you do @aredridel .
Just curious if latest lusca 1.3 has any issues related to csrf mismatch, i have had a lot of trouble with it, i did do whats required:
-
angular passes header with token
$http.defaults.headers.post['XSRF-TOKEN'] = $cookies.get('XSRF-TOKEN'); -
specifying headers
$httpProvider.defaults.xsrfHeaderName = 'X-XSRF-TOKEN';
$httpProvider.defaults.xsrfCookieName = 'XSRF-TOKEN'; -
on express side
csrf: {
angular: true
},
Not using krakenjs
and yet still the same error, any tips?
thank you
from lusca.
Should be working just fine. Do you have a cookie parsing middleware on the express side?
I wrote a little example project a few months back. It's using kraken but the basic principles still apply.
You can see the config I'm using for lusca here. The equivalent for a vanilla express app would be:
var cookieParser = require('cookie-parser');
var express = require('express');
var lusca = require('lusca');
var app = express();
var opts = { csrf: { angular: true } }; // options for lusca
app.use(cookieParser());
app.use(lusca(opts)); // lusca registered AFTER cookieParser
app.listen(8000);
After that, I don't need to do any special configuration in the angular app, itself.
from lusca.
@jasisk Thanks for response.
I read that express no longer requires cookie parser , i tried with and without it.
Are you saying that my angular app doesn't need to try to store a token it receives on the first load and later pass it in its headers?
I've observed something odd, using chrome dev tool, for the moment i use memory as a session store (later ill use redis). Also my angular app (1.5) has ngRoute.
I am curious if this can be a problem:
/?someparam=fdsfds
will redirect to ngroute "/location" like this
return $location.path('/location');
This would probably generate 2 different tokens.
What do you think?
from lusca.
Related Issues (20)
- CSRF error status code HOT 3
- csrf http2 token validation fails while http1 passes HOT 2
- Exempting XSRF-TOKEN for some requests HOT 2
- Support CSRF black/white listing on URL params HOT 2
- X-XSS-Protection report uri HOT 1
- How to send post with CSRF token without manually adding a form or whitelisting/blacklisting HOT 2
- Is helmet needed with lusca? HOT 2
- CSRF blacklist and whitelist not working as expected for multiple endpoints. HOT 1
- DNS Rebinding protection
- lusca requires req.session
- How skip api css js avoid redundant?
- CSRF token missing at app.use(lusca.csrf())
- Nonce is not being generated HOT 2
- CSP policy is wrong when whitespace is missing before 'self'
- Change CSRF-Token name
- Cookie “XSRF-TOKEN” will be soon rejected HOT 1
- lusca.xframe value - "ALLOW-FROM uri" is obselete
- Setting CSRF token on the blacklisted routes.
- Rename csrf blacklist/whitelist configs HOT 1
- CSRF token is mismatch even in correct things. HOT 1
Recommend Projects
-
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
-
Vue.js
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
-
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
-
TensorFlow
An Open Source Machine Learning Framework for Everyone
-
Django
The Web framework for perfectionists with deadlines.
-
Laravel
A PHP framework for web artisans
-
D3
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
-
Recommend Topics
-
javascript
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
-
web
Some thing interesting about web. New door for the world.
-
server
A server is a program made to process requests and deliver data to clients.
-
Machine learning
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
-
Visualization
Some thing interesting about visualization, use data art
-
Game
Some thing interesting about game, make everyone happy.
Recommend Org
-
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
-
Microsoft
Open source projects and samples from Microsoft.
-
Google
Google ❤️ Open Source for everyone.
-
Alibaba
Alibaba Open Source for everyone
-
D3
Data-Driven Documents codes.
-
Tencent
China tencent open source team.
from lusca.