Merge pull request #23 from SLIIT-Y4S2/it21012488

CSRF vulnerability fix

client/src/components/CustomerAccount.js

@@ -112,10 +112,20 @@ function CustomerAccount() {
         console.log("Feedback "+sFeedback)
         const siteFeedback = { name, sFeedback, email}
 
+        const csrfResponse = await fetch('/csrf/generate', {
+          method: 'GET',
+          credentials: 'include'
+        })
+        const csrfData = await csrfResponse.json();
+        const csrfToken = csrfData.csrfToken;
+        console.log("csrfToken", csrfToken);
+
         const response = await fetch('/api/site-feedbacks', {
           method: 'POST',
+          credentials: 'include',
           body: JSON.stringify(siteFeedback),
           headers: {
+            'x-csrf-token': csrfToken, // Include the CSRF token in the header
             'Content-Type': 'application/json'
           }
         })
@@ -128,6 +138,7 @@ function CustomerAccount() {
         }
 
         if (response.ok) {
+          alert('New feedback added');
           console.log('new feedback added', json)
           window.location.reload();
         }

server/controllers/csrf-controller.js

@@ -0,0 +1,19 @@
+require("dotenv").config();
+
+const { doubleCsrf } = require("csrf-csrf");
+
+const doubleCsrfConfig = {
+  getSecret: () => process.env.CSRF_SECRET, // A function that optionally takes the request and returns a secret
+};
+
+const { generateToken, doubleCsrfProtection } = doubleCsrf(doubleCsrfConfig);
+
+const generateCsrfToken = (req, res) => {
+  const csrfToken = generateToken(req, res);
+  res.json({ csrfToken });
+};
+
+module.exports = {
+  generateCsrfToken,
+  doubleCsrfProtection,
+};

server/package.json

@@ -12,8 +12,10 @@
   "license": "ISC",
   "dependencies": {
     "bcrypt": "^5.1.1",
+    "cookie-parser": "^1.4.6",
     "cookie-session": "^2.1.0",
     "cors": "^2.8.5",
+    "csrf-csrf": "^3.0.8",
     "dotenv": "^16.4.5",
     "express": "^4.21.0",
     "express-rate-limit": "^7.4.0",
@@ -28,4 +30,4 @@
     "passport": "^0.5.3",
     "passport-google-oauth20": "^2.0.0"
   }
-}
+}

server/routes/SiteFeedbackRoutes.js

@@ -7,6 +7,7 @@ const {
     updatePublicSiteFeedback,
     updatePrivateSiteFeedback
 } = require('../controllers/siteFeedbackController')
+const { doubleCsrfProtection } = require('../controllers/csrf-controller')
 
 const router = express.Router()
 
@@ -17,7 +18,7 @@ router.get('/private', getPrivateSiteFeedbacks)
 router.get('/public', getPublicSiteFeedbacks)
 
 // POST a new feedback
-router.post('/', createSiteFeedback)
+router.post('/', doubleCsrfProtection, createSiteFeedback)
 
 // DELETE a feedback
 router.delete('/:id', deleteSiteFeedback)

server/routes/csrf-routes.js

@@ -0,0 +1,9 @@
+
+const express = require('express');
+const { generateCsrfToken } = require('../controllers/csrf-controller');
+
+const router = express.Router()
+
+router.get("/generate", generateCsrfToken);
+
+module.exports = router

server/server.js

@@ -14,6 +14,9 @@ const certificate = fs.readFileSync('./security/cert.pem')
 
 const googleOAuthRoutes = require('./routes/google-oauth-routes')
 
+/* CSRF routes */
+const csrfRoutes = require("./routes/csrf-routes");
+
 const userRoutes = require('./routes/userRoutes')
 const siteFeedbacks = require('./routes/SiteFeedbackRoutes')
 
@@ -82,6 +85,8 @@ app.use(deserializeToken);
 const cookieSession = require('cookie-session');
 const passport = require('passport');
 
+const cookieParser = require('cookie-parser');
+
 app.use(
   cookieSession({
     name: "cookie-session",
@@ -98,6 +103,10 @@ app.use(passport.session());
 // Google oauth routes
 app.use('/auth', googleOAuthRoutes)
 
+// CSRF routes and cookie-parser middleware
+app.use(cookieParser());
+app.use("/csrf", csrfRoutes);
+
 // routes
 app.use('/api/users', userRoutes)
 app.use('/api/orders', orderRoutes)