feat: add rotateWhenInvalid option for CSRF token #98
Conversation
WalkthroughThe update introduces a new configuration option, Changes
Assessment against linked issues
Poem
Tip AI model upgrade
|
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 2
Review details
Configuration used: CodeRabbit UI
Review profile: CHILL
Files selected for processing (5)
- README.md (1 hunks)
- README.zh-CN.md (1 hunks)
- app/extend/context.js (1 hunks)
- config/config.default.js (1 hunks)
- test/csrf.test.js (1 hunks)
Additional comments not posted (3)
app/extend/context.js (1)
203-206: Ensure proper logging for CSRF secret rotation.Consider adding logging to indicate when the CSRF secret is rotated for better traceability.
const { rotateWhenInvalid } = this.app.config.security.csrf; if (rotateWhenInvalid) { this.rotateCsrfSecret(); + this.logger.info('CSRF secret rotated due to invalid token'); }README.zh-CN.md (1)
146-146: Ensure clarity in the documentation forrotateWhenInvalid.The documentation for
rotateWhenInvalidis clear and correctly placed.README.md (1)
217-217: Ensure clarity in the documentation forrotateWhenInvalid.The documentation for
rotateWhenInvalidis clear and correctly placed.
| it('token should be rotated when enable rotateWhenInvalid', async () => { | ||
| mm(app.config.security.csrf, 'rotateWhenInvalid', true); | ||
| await app.httpRequest() | ||
| .post('/update') | ||
| .set('x-csrf-token', '2') | ||
| .set('cookie', 'csrfToken=1') | ||
| .send({ title: 'invalid token' }) | ||
| .expect(403) | ||
| .expect(res => assert(!!res.header['set-cookie'])); | ||
| }); |
There was a problem hiding this comment.
Add comments for clarity.
The test function is well-structured and correctly tests the new functionality. Adding comments will improve readability and maintainability.
+ // Test to check if the CSRF token is rotated when `rotateWhenInvalid` is enabled
it('token should be rotated when enable rotateWhenInvalid', async () => {
+ // Mock the `rotateWhenInvalid` configuration to true
mm(app.config.security.csrf, 'rotateWhenInvalid', true);
+ // Perform an HTTP request with an invalid CSRF token
await app.httpRequest()
.post('/update')
.set('x-csrf-token', '2')
.set('cookie', 'csrfToken=1')
.send({ title: 'invalid token' })
.expect(403)
+ // Assert that the CSRF token is rotated by checking the `set-cookie` header
.expect(res => assert(!!res.header['set-cookie']));
});Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
| it('token should be rotated when enable rotateWhenInvalid', async () => { | |
| mm(app.config.security.csrf, 'rotateWhenInvalid', true); | |
| await app.httpRequest() | |
| .post('/update') | |
| .set('x-csrf-token', '2') | |
| .set('cookie', 'csrfToken=1') | |
| .send({ title: 'invalid token' }) | |
| .expect(403) | |
| .expect(res => assert(!!res.header['set-cookie'])); | |
| }); | |
| // Test to check if the CSRF token is rotated when `rotateWhenInvalid` is enabled | |
| it('token should be rotated when enable rotateWhenInvalid', async () => { | |
| // Mock the `rotateWhenInvalid` configuration to true | |
| mm(app.config.security.csrf, 'rotateWhenInvalid', true); | |
| // Perform an HTTP request with an invalid CSRF token | |
| await app.httpRequest() | |
| .post('/update') | |
| .set('x-csrf-token', '2') | |
| .set('cookie', 'csrfToken=1') | |
| .send({ title: 'invalid token' }) | |
| .expect(403) | |
| // Assert that the CSRF token is rotated by checking the `set-cookie` header | |
| .expect(res => assert(!!res.header['set-cookie'])); | |
| }); |
| @@ -42,6 +42,7 @@ module.exports = () => { | |||
| headerName: 'x-csrf-token', | |||
| bodyName: '_csrf', | |||
| queryName: '_csrf', | |||
| rotateWhenInvalid: false, | |||
There was a problem hiding this comment.
Add documentation for the new rotateWhenInvalid option.
Ensure that the new rotateWhenInvalid option is documented within the comments for the csrf configuration.
* @property {Object} csrf - whether defend csrf attack
* @property {Object} xframe - whether enable X-Frame-Options response header, default SAMEORIGIN
* @property {Object} hsts - whether enable Strict-Transport-Security response header, default is one year
* @property {Object} methodnoallow - whether enable Http Method filter
* @property {Object} noopen - whether enable IE automaticlly download open
* @property {Object} nosniff - whether enable IE8 automaticlly dedect mime
* @property {Object} xssProtection - whether enable IE8 XSS Filter, default is open
* @property {Object} csp - content security policy config
* @property {Object} referrerPolicy - referrer policy config
* @property {Object} dta - auto avoid directory traversal attack
* @property {Array} domainWhiteList - domain white list
* @property {Array} protocolWhiteList - protocal white list
* @property {Boolean} rotateWhenInvalid - rotate CSRF secret when token is invalid
*/Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
| rotateWhenInvalid: false, | |
| * @property {Object} csrf - whether defend csrf attack | |
| * @property {Object} xframe - whether enable X-Frame-Options response header, default SAMEORIGIN | |
| * @property {Object} hsts - whether enable Strict-Transport-Security response header, default is one year | |
| * @property {Object} methodnoallow - whether enable Http Method filter | |
| * @property {Object} noopen - whether enable IE automaticlly download open | |
| * @property {Object} nosniff - whether enable IE8 automaticlly dedect mime | |
| * @property {Object} xssProtection - whether enable IE8 XSS Filter, default is open | |
| * @property {Object} csp - content security policy config | |
| * @property {Object} referrerPolicy - referrer policy config | |
| * @property {Object} dta - auto avoid directory traversal attack | |
| * @property {Array} domainWhiteList - domain white list | |
| * @property {Array} protocolWhiteList - protocal white list | |
| * @property {Boolean} rotateWhenInvalid - rotate CSRF secret when token is invalid |
|
commit: egg-security
|
There was a problem hiding this comment.
Actionable comments posted: 0
Review details
Configuration used: CodeRabbit UI
Review profile: CHILL
Files selected for processing (2)
- README.md (1 hunks)
- README.zh-CN.md (1 hunks)
Files skipped from review as they are similar to previous changes (2)
- README.md
- README.zh-CN.md
|
@hongzzz 很棒的功能！感谢贡献！ |
[skip ci] ## [3.5.0](v3.4.0...v3.5.0) (2024-07-03) ### Features * add rotateWhenInvalid option for CSRF token ([#98](#98)) ([ae37c8f](ae37c8f))
closes #97
Summary by CodeRabbit
New Features
rotateWhenInvalidto control CSRF token rotation when invalid, enhancing overall security.Documentation
README.mdandREADME.zh-CN.mdto include the newrotateWhenInvalidconfiguration option.Tests
rotateWhenInvalidis enabled.