Question

我尝试使用https://github.com/expressjs/csurf中的expressjs csurf示例在使用自述文件中的第一个示例时（使用Ejs模板语言），令牌验证工作正常。当我尝试使用＆＃39;忽略路线＆＃39;例如，在＆＃39; GET /表格＆＃39;到＆＃39; POST / process＆＃39;执行（就像我在第一个例子中所做的那样），我得到了无效的令牌＆＃39;在＆＃39; POST / process＆＃39;。令牌将传递给GET上的表单。有什么想法吗？

＆＃39; app.use（csrfProtection）＆＃39;不工作？（在非工作示例中使用，如果我删除＆＃39; use（csrfP ..＆＃39;并使用工作示例中的方法来使用csrf模块，IE，传递＆＃39; csrfProtection＆＃39;对于＆＃39; get＆＃39;＆＃39; post＆＃39;方法，第二个例子有效）

使用：

var cookieParser = require('cookie-parser')
var csrf = require('csurf')
var bodyParser = require('body-parser')
var express = require('express')

// setup route middlewares
var csrfProtection = csrf({ cookie: true })
var parseForm = bodyParser.urlencoded({ extended: false })

// create express app
var app = express()

app.set('view engine', 'ejs')

// parse cookies
// we need this because "cookie" is true in csrfProtection
app.use(cookieParser())

app.get('/form', csrfProtection, function(req, res) {
  // pass the csrfToken to the view
  var tkn = req.csrfToken()
  console.log(tkn)
  res.render('index', { csrfToken: tkn })
})

app.post('/process', parseForm, csrfProtection, function(req, res) {
  res.send('data is being processed')
})

var server = app.listen(8081, function () {

  var host = server.address().address
  var port = server.address().port

  console.log("Example app listening at http://%s:%s", host, port)

})

的HTML / EJS：

<!DOCTYPE html>  
<html lang="en">  
  <head>
  </head>
  <body>
    <form action="/process" method="POST">
        <input type="hidden" name="_csrf" value="<%= csrfToken %>">
        Favorite color: <input type="text" name="favoriteColor">
        <button type="submit">Submit</button>
    </form>
  </body>
</html>

不起作用：

var cookieParser = require('cookie-parser')
var csrf = require('csurf')
var bodyParser = require('body-parser')
var express = require('express')

// setup route middlewares
var csrfProtection = csrf({ cookie: true })
var parseForm = bodyParser.urlencoded({ extended: false })

// create express app
var app = express()

app.set('view engine', 'ejs')

// parse cookies
// we need this because "cookie" is true in csrfProtection
app.use(cookieParser())

// create api router
var api = createApiRouter()

// mount api before csrf is appended to the app stack
app.use('/api', api)

// now add csrf, after the "/api" was mounted
app.use(csrfProtection)

app.get('/form', function(req, res) {
  // pass the csrfToken to the view
  var tkn = req.csrfToken()
  console.log(tkn)
  res.render('index', { csrfToken: tkn })
})

app.post('/process', parseForm, function(req, res) {
  res.send('csrf was required to get here')
})

function createApiRouter() {
  var router = new express.Router()

  router.post('/getProfile', function(req, res) {
    res.send('no csrf to get here')
  })

  return router
}

var server = app.listen(8081, function () {

  var host = server.address().address
  var port = server.address().port

  console.log("Example app2 listening at http://%s:%s", host, port)

})

Answer 1

在第二个示例中，您没有将csrfProtection中间件传递给POST处理链。它应该是

app.post('/process', parseForm, csrfProtection, function(req, res) {
  res.send('csrf was required to get here')
})

使用expressjs的无效令牌csurf中间件示例

1 个答案: