scout_ante/dashboard
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

CSRF protection

Browse Source
This commit is contained in:
rxdn 2021-01-15 22:29:26 +00:00
parent 84fa811a4a
commit f5985f9f7a
4 changed files with 21 additions and 5 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
app/http/endpoints/api/token.go
View File

@ -13,7 +13,7 @@ import (
func TokenHandler(ctx *gin.Context) {
session := sessions.Default(ctx)
userId := utils.GetUserId(session)
//TODO : CSRF
token := jwt.NewWithClaims(jwt.SigningMethodHS256, jwt.MapClaims{
"userid": strconv.FormatUint(userId, 10),
})

12
app/http/middleware/verifyheader.go Normal file
View File

@ -0,0 +1,12 @@
package middleware
import (
"github.com/TicketsBot/GoPanel/utils"
"github.com/gin-gonic/gin"
)
func VerifyXTicketsHeader(ctx *gin.Context) {
if ctx.GetHeader("x-tickets") != "true" {
ctx.AbortWithStatusJSON(400, utils.ErrorStr("Missing x-tickets header"))
}
}

4
app/http/server.go
View File

@ -59,7 +59,7 @@ func StartServer() {
authorized := router.Group("/", middleware.AuthenticateCookie)
{
authorized.POST("/token", api.TokenHandler)
authorized.POST("/token", middleware.VerifyXTicketsHeader, api.TokenHandler)
authenticateGuildAdmin := authorized.Group("/", middleware.AuthenticateGuild(false, permission.Admin))
authenticateGuildSupport := authorized.Group("/", middleware.AuthenticateGuild(false, permission.Support))
@ -80,7 +80,7 @@ func StartServer() {
authorized.GET("/webchat", manage.WebChatWs)
}
apiGroup := router.Group("/api", middleware.AuthenticateToken)
apiGroup := router.Group("/api", middleware.VerifyXTicketsHeader, middleware.AuthenticateToken)
guildAuthApiAdmin := apiGroup.Group("/:id", middleware.AuthenticateGuild(true, permission.Admin))
guildAuthApiSupport := apiGroup.Group("/:id", middleware.AuthenticateGuild(true, permission.Support))
{

8
public/static/js/auth.js
View File

@ -1,8 +1,11 @@
async function getToken() {
let token = window.localStorage.getItem('token');
if (token == null) {
let res = await axios.post('/token', {
withCredentials: true
let res = await axios.post('/token', undefined, {
withCredentials: true,
headers: {
'x-tickets': 'true'
}
});
if (res.status !== 200 || !res.data.success) {
@ -25,6 +28,7 @@ function clearLocalStorage() {
async function setDefaultHeader() {
const token = await getToken();
axios.defaults.headers.common['Authorization'] = token;
axios.defaults.headers.common['x-tickets'] = 'true'; // abritrary header name and value
axios.defaults.validateStatus = false;
}