Mirrors/wg-portal
1
0
Fork 0
mirror of https://github.com/h44z/wg-portal.git synced 2025-04-19 08:55:12 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

fix: fix csrf token handling after login

Browse Source
This commit is contained in:
Christoph Haas 2025-03-29 17:21:54 +01:00
parent 6cbccf6d43
commit 3723e4cc75
2 changed files with 9 additions and 5 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

8
frontend/src/router/index.js
View File

@ -72,7 +72,6 @@ const router = createRouter({
router.beforeEach(async (to) => { router.beforeEach(async (to) => {
const auth = authStore() const auth = authStore()
const sec = securityStore()
// check if the request was a successful oauth login // check if the request was a successful oauth login
if ('wgLoginState' in to.query && !auth.IsAuthenticated) { if ('wgLoginState' in to.query && !auth.IsAuthenticated) {
@ -122,8 +121,13 @@ router.beforeEach(async (to) => {
auth.SetReturnUrl(to.fullPath) // store original destination before starting the auth process auth.SetReturnUrl(to.fullPath) // store original destination before starting the auth process
return '/login' return '/login'
} }
})
if (publicPages.includes(to.path)) { router.afterEach(async (to, from) => {
const sec = securityStore()
const csrfPages = ['/login']
if (csrfPages.includes(to.path)) {
await sec.LoadSecurityProperties() // make sure we have a valid csrf token await sec.LoadSecurityProperties() // make sure we have a valid csrf token
} }
}) })

6
internal/app/api/core/middleware/csrf/middleware.go
View File

@ -68,14 +68,14 @@ func (m *Middleware) RefreshToken(next http.Handler) http.Handler {
// mask the token // mask the token
maskedToken := maskToken(token, key) maskedToken := maskToken(token, key)
// store the encoded token in the session
encodedToken := encodeToken(maskedToken) encodedToken := encodeToken(maskedToken)
m.o.sessionWriter(r, encodedToken)
// pass the token down the chain via the context // pass the token down the chain via the context
r = r.WithContext(setToken(r.Context(), encodedToken)) r = r.WithContext(setToken(r.Context(), encodedToken))
// store the token in the session
m.o.sessionWriter(r, encodedToken)
next.ServeHTTP(w, r) next.ServeHTTP(w, r)
}) })
} }