All files index.js

73.47% Statements 36/49
36.96% Branches 17/46
83.33% Functions 5/6
80% Lines 28/35
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74    1x       1x   1x   1x   1x   1x 1x   1x   1x   3x   3x   3x   3x   3x   3x     3x       3x                             1x   1x   1x   1x   1x   1x   1x   1x   1x     1x 1x
'use strict';
 
Object.defineProperty(exports, "__esModule", {
  value: true
});
 
var _csrf = require('csrf');
 
var _csrf2 = _interopRequireDefault(_csrf);
 
function _interopRequireDefault(obj) { return obj && obj.__esModule ? obj : { default: obj }; }
 
function _classCallCheck(instance, Constructor) { Iif (!(instance instanceof Constructor)) { throw new TypeError("Cannot call a class as a function"); } }
 
var CSRF = function CSRF(opts) {
  var _this = this;
 
  _classCallCheck(this, CSRF);
 
  this.middleware = function (ctx, next) {
 
    ctx.__defineGetter__('csrf', function () {
 
      Iif (ctx._csrf) return ctx._csrf;
 
      Iif (!ctx.session) return null;
 
      if (!ctx.session.secret) ctx.session.secret = _this.tokens.secretSync();
 
      ctx._csrf = _this.tokens.create(ctx.session.secret);
 
      return ctx._csrf;
    });
 
    ctx.response.__defineGetter__('csrf', function () {
      return ctx.csrf;
    });
 
    Eif (_this.opts.excludedMethods.indexOf(ctx.method) !== -1) return next();
 
    if (!ctx.session.secret) ctx.session.secret = _this.tokens.secretSync();
 
    var bodyToken = ctx.request.body && typeof ctx.request.body._csrf === 'string' ? ctx.request.body._csrf : false;
 
    var token = bodyToken || !_this.opts.disableQuery && ctx.query && ctx.query._csrf || ctx.get('csrf-token') || ctx.get('xsrf-token') || ctx.get('x-csrf-token') || ctx.get('x-xsrf-token');
 
    if (!token) return ctx.throw(_this.opts.invalidTokenStatusCode, _this.opts.invalidTokenMessage);
 
    if (!_this.tokens.verify(ctx.session.secret, token)) return ctx.throw(_this.opts.invalidTokenStatusCode, _this.opts.invalidTokenMessage);
 
    return next();
  };
 
  this.opts = opts || {};
 
  Eif (!this.opts.invalidSessionSecretMessage) this.opts.invalidSessionSecretMessage = 'Invalid session secret';
 
  Eif (!this.opts.invalidSessionSecretStatusCode) this.opts.invalidSessionSecretStatusCode = 403;
 
  Eif (!this.opts.invalidTokenMessage) this.opts.invalidTokenMessage = 'Invalid CSRF token';
 
  Eif (!this.opts.invalidTokenStatusCode) this.opts.invalidTokenStatusCode = 403;
 
  Eif (!this.opts.excludedMethods) this.opts.excludedMethods = ['GET', 'HEAD', 'OPTIONS'];
 
  Eif (typeof this.opts.disableQuery !== 'boolean') this.opts.disableQuery = false;
 
  this.tokens = (0, _csrf2.default)(opts);
 
  return this.middleware;
};
 
exports.default = CSRF;
module.exports = exports['default'];