在快递中提交表单时,CSRF令牌无效

Question

我正在尝试在我的快递应用程序中运行表单.我有一个中间件函数,它将csrf标记req.session._csrf传递给res.locals.csrf_token,因此视图可以使用它.现在我正在尝试在我的视图中使用局部变量,我从会话中间件中得到一个禁止的错误.

这是我的表格代码 - 我正在使用把手作为我的模板引擎:

  <form method='post' action='/api/entries' enctype='multipart/form-data' >
    <input type='hidden' name='_csrf' value={{csrf_token}} />
    <input class='foo' type='text' />
    <input class='bar' type='text' />
    <button id='submit' type='submit'> SUBMIT
  </form>

我试过引用带有和不带双花括号的csrf_token变量,但都不起作用.关于我做错了什么的任何想法？错误:Forbidden发生在我的路由函数之前甚至调用POST/to/api/entries.所以我很确定问题是我在引用csrf令牌时出错了.

*编辑:*关于"req.session._csrf已被弃用,请使用req.csrfToken()而不是"登录到控制台,我做了:

grep -r '_csrf' .

在我的app目录中.这是输出..它看起来不像我在视图之外的任何地方引用它,我隐藏的CSRF字段被命名为"_csrf"..

./node_modules/express/node_modules/connect/lib/middleware/csrf.js:    var secret = req.session._csrfSecret;
./node_modules/express/node_modules/connect/lib/middleware/csrf.js:      req.session._csrfSecret = secret;
./node_modules/express/node_modules/connect/lib/middleware/csrf.js:      Object.defineProperty(req.session, '_csrf', {
./node_modules/express/node_modules/connect/lib/middleware/csrf.js:          console.warn('req.session._csrf is deprecated, use req.csrfToken() instead');
./node_modules/express/node_modules/connect/lib/middleware/csrf.js:  return (req.body && req.body._csrf)
./node_modules/express/node_modules/connect/lib/middleware/csrf.js:    || (req.query && req.query._csrf)
./v/home.hbs:    <input type='hidden' name='_csrf' value={{csrf_token}} />
./v/show.hbs:  <input type='hidden'  name='_csrf' value={{csrf_token}} />

这是我在尝试POST到/ api/entries端点时得到的整个错误堆栈(我之前愚蠢地忽略了这一点,但我正在使用connect-redis用于会话中间件):

Error: Forbidden
    at Object.exports.error (appFolder/node_modules/express/node_modules/connect/lib/utils.js:63:13)
    at createToken (appFolder/node_modules/express/node_modules/connect/lib/middleware/csrf.js:82:55)
    at Object.handle (appFolder/node_modules/express/node_modules/connect/lib/middleware/csrf.js:48:24)
    at next (appFolder/node_modules/express/node_modules/connect/lib/proto.js:193:15)
    at next (appFolder/node_modules/express/node_modules/connect/lib/middleware/session.js:318:9)
    at appFolder/node_modules/express/node_modules/connect/lib/middleware/session.js:342:9
    at appFolder/node_modules/connect-redis/lib/connect-redis.js:101:14
    at try_callback (appFolder/node_modules/redis/index.js:580:9)
    at RedisClient.return_reply (appFolder/node_modules/redis/index.js:670:13)
    at ReplyParser.<anonymous> (appFolder/node_modules/redis/index.js:312:14)

编辑2: connect-redis.js中的错误是一个试图通过会话ID获取当前会话并失败的函数.不知道为什么会发生这种情况,我的connect-redis设置看起来是正确的.这是在杀我

Answer 1

编辑:如果您不需要文件上传,请不要使用multipart/form-dataenctype.切换到默认的enctype将允许express.csrf()解析_csrf令牌.

multipart/form-data要使用enctype 解析表单,您需要在应用程序配置中使用多部分解析器,或自己处理文件上载.建议避免使用包含的内容express.bodyParser(),而是使用类似于busboy或formidable希望文件上传的路由,以防止利用.

如果你走这条路线,你的_csrf字段将不再被捕获,express.csrf()因为在请求通过该中间件之后才会解析表单体.设置您的表单操作以'/api/entries?_csrf={{csrf_token}}'解决此问题.

var fs = require('fs');
var async = require('async');
var express = require('express');
var formidable = require('formidable');
var app = express();

app.use(express.urlencoded())
  .use(express.json())
  .use(express.cookieParser())
  .use(express.session())
  .use(express.csrf())

app.get('/upload', function(req, res) {
  // File uploads ignored.
  res.render('upload', {_csrf:req.csrfToken()});
});

app.post('/upload', function(req, res) {
  // Explicitly handle uploads
  var form = new formidable.IncomingForm();
  form.uploadDir = 'temp';

  var count = 0;
  var maxAllowed = 10;

  form.onPart = function(part) {
    if (!part.filename) return form.handlePart(part);

    count++;

    // Ignore any more files.
    if (count > maxAllowed) return part.resume();

    form.handlePart(part);
  };

  form.parse(req, function(err, fields, files) {
    // Process the files. If you don't need them, delete them.
    // Note that you should still reap your temp directory on occasion.

    async.map(Object.keys(files), function(key, cb) {
      fs.unlink(files[key].path, cb);
    }, function(err) {
      res.end();
    });
   });
});

Answer 2

在最新版本的Express/Connect中,CSRF语法略有改变.您现在希望中间件看起来像这样:

.use(express.csrf())
.use(function (req, res, next) {
  res.cookie('XSRF-TOKEN', req.csrfToken());
  res.locals.csrftoken = req.csrfToken();
  next();
})

要测试代码,请注意您首先需要获取表单页面以生成CSRF令牌.只有这样你的POST才能成功.如果失败,则需要在尝试再次POST之前在浏览器中重新加载页面.