fix: added CSRF check for granting access via session authentication - Githubissues

sasjs / server

Build Apps on Base SAS

https://server.sasjs.io

MIT License

20 stars 3 forks source link

fix: added CSRF check for granting access via session authentication #155

Closed saadjutt01 closed 2 years ago

saadjutt01 commented 2 years ago

Session based authentication is already implemented. Web apps need to access APIs without access token and utilise their valid session.

Access is granted to secured APIs if session is valid.

Intent

Need to add CSRF protection to all requests trying to access API with valid session.

Implementation

Added CSRF protection to authenticateAccessToken
Added CSRF protection to all web routes
Setting CSRF Token upon SPA render only