mirror of
https://github.com/profullstack/logicsrc.git
synced 2026-08-13 14:37:26 +00:00
Anthony Ettinger
898d5503b8
Two bugs on the dashboard, both fixed by handing appBar/CLI_HINT the request. Sign-out was broken for everyone. csrfGuard rejects any POST whose _csrf does not match the mc_csrf cookie, and /auth/logout is a POST that is not on the exempt list, but the sign-out form carried no hidden field -- every click answered 403 "bad csrf token". appBar now takes the request rather than the user, because it needs the token as well as the identity. The field is written out instead of reusing csrfInput(): html.mjs is the view layer and imports nothing, and pulling in session.mjs would drag the database driver with it. The "Connect the CLI" snippet still printed $PUBLIC_ORIGIN, so users on app.logicsrc.com were told to point LOGICSRC_API at the generated Railway hostname. #105 added requestOrigin() for exactly this and fixed the device-flow URLs; the dashboard hint was missed. It now follows the request too, which is not a hardcode swap -- the same deployment answering on its Railway hostname still self-describes correctly. Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
39 lines
1.6 KiB
JavaScript
39 lines
1.6 KiB
JavaScript
// Signing out is a POST and csrfGuard rejects any POST whose _csrf does not
|
|
// match the mc_csrf cookie. The Sign out form shipped without that field, so
|
|
// every click answered "bad csrf token" and nobody could log out. These pin the
|
|
// hidden input in place.
|
|
import assert from "node:assert/strict";
|
|
import test from "node:test";
|
|
|
|
import { appBar } from "../src/lib/html.mjs";
|
|
|
|
const req = (extra = {}) => ({ csrfToken: "deadbeefdeadbeef", user: { email: "a@example.com" }, ...extra });
|
|
|
|
test("the sign-out form carries the CSRF token", () => {
|
|
const html = appBar(req());
|
|
assert.match(html, /action="\/auth\/logout"/);
|
|
assert.match(html, /<input type="hidden" name="_csrf" value="deadbeefdeadbeef">/);
|
|
// the field has to be inside the form, not merely somewhere on the page
|
|
const form = html.slice(html.indexOf('action="/auth/logout"'));
|
|
assert.ok(
|
|
form.indexOf('name="_csrf"') < form.indexOf("</form>"),
|
|
"the _csrf input must be inside the sign-out form",
|
|
);
|
|
});
|
|
|
|
test("signed-out visitors get no sign-out form at all", () => {
|
|
const html = appBar({ user: null, csrfToken: "x" });
|
|
assert.doesNotMatch(html, /\/auth\/logout/);
|
|
assert.match(html, /Sign in/);
|
|
});
|
|
|
|
test("survives a request with no CSRF token rather than printing undefined", () => {
|
|
const html = appBar(req({ csrfToken: undefined }));
|
|
assert.match(html, /name="_csrf" value=""/);
|
|
});
|
|
|
|
test("the signed-in identity is escaped", () => {
|
|
const html = appBar(req({ user: { email: '<script>alert(1)</script>' } }));
|
|
assert.doesNotMatch(html, /<script>alert/);
|
|
assert.match(html, /<script>/);
|
|
});
|