hiro/lack
1
0
Fork 0
mirror of https://github.com/vale981/lack synced 2025-03-05 09:21:39 -05:00
Code Issues Projects Releases Packages Wiki Activity Actions

Change the option name of CSRF token to ':session-key'.

Browse source
This commit is contained in:
Eitaro Fukamachi 2018-04-12 17:23:32 +09:00
parent 9ae2c5df7c
commit 2c1c0df583
1 changed files with 8 additions and 8 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

16
src/middleware/csrf.lisp
View file

@ -11,13 +11,13 @@
:csrf-html-tag)) :csrf-html-tag))
(in-package :lack.middleware.csrf) (in-package :lack.middleware.csrf)
(defvar *csrf-token-key*) (defvar *csrf-session-key*)
(defparameter *lack-middleware-csrf* (defparameter *lack-middleware-csrf*
(lambda (app &key (block-app #'return-400) one-time (lambda (app &key (block-app #'return-400) one-time
(csrf-token-key :csrf-token)) (session-key :csrf-token))
(lambda (env) (lambda (env)
(let ((*csrf-token-key* csrf-token-key)) (let ((*csrf-session-key* session-key))
(block nil (block nil
(unless (danger-method-p (getf env :request-method)) (unless (danger-method-p (getf env :request-method))
(return (funcall app env))) (return (funcall app env)))
@ -29,7 +29,7 @@
(if (valid-token-p env) (if (valid-token-p env)
(progn (progn
(when one-time (when one-time
(remhash csrf-token-key session)) (remhash *csrf-session-key* session))
(funcall app env)) (funcall app env))
(funcall block-app env))))))) (funcall block-app env)))))))
"Middleware for easy CSRF protection") "Middleware for easy CSRF protection")
@ -48,7 +48,7 @@
(defun valid-token-p (env) (defun valid-token-p (env)
(let ((req (make-request env)) (let ((req (make-request env))
(csrf-token (gethash *csrf-token-key* (csrf-token (gethash *csrf-session-key*
(getf env :lack.session)))) (getf env :lack.session))))
(and csrf-token (and csrf-token
(let ((recieved-csrf-token (let ((recieved-csrf-token
@ -56,9 +56,9 @@
(string= csrf-token recieved-csrf-token))))) (string= csrf-token recieved-csrf-token)))))
(defun csrf-token (session) (defun csrf-token (session)
(unless (gethash *csrf-token-key* session) (unless (gethash *csrf-session-key* session)
(setf (gethash *csrf-token-key* session) (generate-random-id))) (setf (gethash *csrf-session-key* session) (generate-random-id)))
(gethash *csrf-token-key* session)) (gethash *csrf-session-key* session))
(defun csrf-html-tag (session) (defun csrf-html-tag (session)
(format nil "<input type=\"hidden\" name=\"_csrf_token\" value=\"~A\">" (format nil "<input type=\"hidden\" name=\"_csrf_token\" value=\"~A\">"