Merge pull request #499 from finos/492-error-csrf-token-missing

Re-introduce CSRF protection with Lusca ❤️ #497
finos · Mar 25, 2024 · ad05a96 · ad05a96
2 parents a6717e4 + 0285857
commit ad05a96
Show file tree

Hide file tree

Showing 3 changed files with 23 additions and 0 deletions.
diff --git a/package-lock.json b/package-lock.json
diff --git a/package.json b/package.json
@@ -44,6 +44,7 @@
     "jsonschema": "^1.4.1",
     "load-plugin": "^6.0.0",
     "lodash": "^4.17.21",
+    "lusca": "^1.7.0",
     "moment": "^2.29.4",
     "mongodb": "^5.0.0",
     "nodemailer": "^6.6.1",

diff --git a/src/service/index.js b/src/service/index.js
@@ -4,6 +4,7 @@ const http = require('http');
 const cors = require('cors');
 const app = express();
 const rateLimit = require('express-rate-limit');
+const lusca = require('lusca');
 
 const limiter = rateLimit({
   windowMs: 15 * 60 * 1000, // 15 minutes
@@ -40,6 +41,7 @@ const start = async () => {
   app.use(express.json());
   app.use(express.urlencoded({ extended: true }));
   app.use('/', routes);
+  app.use(lusca.csrf());
 
   await _httpServer.listen(uiPort);