Question

我想在express服务器中实现graphql，但是由于在服务器graphql中使用csurf，因此出现以下错误：ForbiddenError：无效的csrf令牌。而且我不知道如何在侧面graphql系统中使用csrf保护。如果有人知道，请告诉我

ForbiddenError：无效的CSRF令牌在csrf（G：\ Project \ API \ UserManagement \ node_modules \ csurf \ index.js：112：19）

import express      from 'express';
import mongoose     from 'mongoose';
import bodyParser   from 'body-parser';
import passport     from 'passport';
import path         from 'path';
import session      from 'express-session';
import cookieParser from 'cookie-parser'
import cors         from 'cors';
import csrf         from 'csurf';
import xssFilter    from 'x-xss-protection';
import hpp          from 'hpp';
import helmet       from 'helmet';
import userRouter from '../routes/userRouter';
import rootRouter from '../routes/rootRouter';

import expressGraphql from 'express-graphql';
import schema         from '../schema';

require('../services/passport');

/////////////////START DATABASE CONFIG///////////////////////////
mongoose.connect(process.env.DB_ADDRESS,{ useNewUrlParser: true });
mongoose.connection.on('connected'   ,()=>{console.log("connection established successfully")});
mongoose.connection.on('error'       ,(err)=>{console.log('connection to mongo failed ' + err)});
mongoose.connection.on('disconnected',()=>{console.log('mongo db connection closed')})
mongoose.set('useCreateIndex', true);

mongoose.Promise = global.Promise;

/////////////////END DATABASE CONFIG///////////////////////////
const app = express();
app.use(helmet())
app.use(helmet.noSniff())
app.use(helmet.ieNoOpen())
/////////////////START APP MIDDLEWARE///////////////////////////
require('dotenv').config({
    path:path.resolve(process.cwd(),'config/keys/.env')
})
app.use(cookieParser())
app.use(bodyParser.json());
app.use(bodyParser.urlencoded({extended:true}))
app.use(hpp())
app.disable('x-powered-by')

const whiteList = [process.env.CORS_APPROVED_ADDRESS,`http://localhost:${process.env.PORT}`];
const corsOptionsDelegate = {
    origin:(origin,cb)=>{
        ( whiteList.indexOf(origin) !== -1 || !origin)?
            cb(null,true)
           :cb(new Error('Not allowed by CORS'));
    }
}
app.use(cors(corsOptionsDelegate))

///////////////END APP MIDDLEWARE///////////////////////////
let RedisStore = require('connect-redis')(session);

app.use(session({
    secret:"3f9faa8bc0e722172cc0bdafede9f3f217474e47",
    resave:false,
    saveUninitialized:false,
    store:new RedisStore({
        prefix:"session:auth:"
    }),
    cookie:{
        maxAge:30 * 24 * 60 * 60 * 1000,
        httpOnly:true,
    }
}))
app.use(csrf())
app.use(xssFilter())
app.use(passport.initialize())
app.use(passport.session())
////////////////START GRAPHQL CONFIG///////////////////////////
app.use('/graphql',expressGraphql({
    schema,
    graphiql:true
}))
////////////////START ROUTER CONFIG///////////////////////////
app.use('/',userRouter)
app.use('/',rootRouter)
/////////////////END ROUTER CONFIG///////////////////////////

export default app;

Answer 1

使用graphql或rest端点时，您实际上不必担心使用CSRF保护。对服务的请求应该是无状态的，并且不应真正依赖Cookie或会话数据。

我建议您阅读以下内容（它同样适用于graphql，因为它是一个api）： https://security.stackexchange.com/questions/166724/should-i-use-csrf-protection-on-rest-api-endpoints

Answer 2

cookie:{
    maxAge:30 * 24 * 60 * 60 * 1000,
    httpOnly:true,
    sameSite: "lax", //csrf security

}

sameSite:"lax" 将处理 csrf 安全性。更多：

https://portswigger.net/web-security/csrf/samesite-cookies

Graphql无效的CSRF令牌

2 个答案: