nestjs csrf

https://gitissue.com/repos/jiayisheji/blog

pass csrf https://github.com/expressjs/csurf/issues/21

main.ts

  
import { NestFactory } from '@nestjs/core';  
import { NestExpressApplication } from '@nestjs/platform-express';  
import { join } from 'path'  
import { AppModule } from './app.module';  
import * as cookieSession from 'cookie-session';  
import * as helmet from 'helmet';  
import * as cookieParser from 'cookie-parser';  
import * as csurf from 'csurf';  
import * as rateLimit from 'express-rate-limit';  
  
async function bootstrap() {  
  const app = await NestFactory.create(  
    AppModule,  
  );  
  
  app.init()  
    
  app.useStaticAssets(join(__dirname, '..', 'public'));  
  app.setBaseViewsDir(join(__dirname, '..', 'views'));  
  app.setViewEngine('pug');  
  
  app.set('trust proxy', 1);  
  
  app.use(cookieSession({  
    name: 'session',  
    keys: ['key1', 'key2']  
  }));  
  
  //app.enableCors();  
  app.use(helmet());  
  app.use(cookieParser());  
  //app.use(csurf({ cookie: true }));  //正常是這行，但有些API POST時需要略過csrf  
  app.use(function (req, res, next) {  
    var mw = csurf({ cookie: true });  
    // console.log(req.url)  // check real get url  
    if (req.url === '/testpostcsrf') return next();  //pass csrf check  
    mw(req, res, next);  
  });  
  app.use(  
    rateLimit({  
      windowMs: 15 * 60 * 1000, // 15 minutes  
      max: 100, // limit each IP to 100 requests per windowMs  
    }),  
  );  
  
  await app.listen(3000);  
}  
bootstrap();  

layout.pug

  
doctype html  
html  
  head  
    title= title  
    meta(content= csrfToken, name='csrf-token')  
  body  
    block content  

login.pug

  
extends layout  
  
block content  
    h1 Please log in  
    if error  
        p.  
            #{error}  
    form(action="/login",method="POST")  
        input(type="hidden",name="_csrf",value=csrfToken)  
        input(type="hidden",name="challenge",value=challenge)  
        table(style="")  
            tr  
                td  
                    input(type="email",id="email",name="email",placeholder="email@foobar.com")  
                td.  
                    (Example: "foo@bar.com")  
            tr  
                td  
                    input(type="password",id="password",name="password")  
                td.  
                    (Example: "foobar")  
        input(type="checkbox",id="remember",name="remember",value="1")  
        label(for="remember") Remember me  
        br  
        input(type="submit",id="accept",value="Log in")