hiro/lack
1
0
Fork 0
mirror of https://github.com/vale981/lack synced 2025-03-05 09:21:39 -05:00
Code Issues Projects Releases Packages Wiki Activity Actions

Change the option name of CSRF token to ':session-key'.

Browse source
This commit is contained in:
Eitaro Fukamachi 2018-04-12 17:23:32 +09:00
parent 9ae2c5df7c
commit 2c1c0df583
1 changed files with 8 additions and 8 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

16
src/middleware/csrf.lisp
View file

@ -11,13 +11,13 @@
:csrf-html-tag))
(in-package :lack.middleware.csrf)
(defvar *csrf-token-key*)
(defvar *csrf-session-key*)
(defparameter *lack-middleware-csrf*
(lambda (app &key (block-app #'return-400) one-time
(csrf-token-key :csrf-token))
(session-key :csrf-token))
(lambda (env)
(let ((*csrf-token-key* csrf-token-key))
(let ((*csrf-session-key* session-key))
(block nil
(unless (danger-method-p (getf env :request-method))
(return (funcall app env)))
@ -29,7 +29,7 @@
(if (valid-token-p env)
(progn
(when one-time
(remhash csrf-token-key session))
(remhash *csrf-session-key* session))
(funcall app env))
(funcall block-app env)))))))
"Middleware for easy CSRF protection")
@ -48,7 +48,7 @@
(defun valid-token-p (env)
(let ((req (make-request env))
(csrf-token (gethash *csrf-token-key*
(csrf-token (gethash *csrf-session-key*
(getf env :lack.session))))
(and csrf-token
(let ((recieved-csrf-token
@ -56,9 +56,9 @@
(string= csrf-token recieved-csrf-token)))))
(defun csrf-token (session)
(unless (gethash *csrf-token-key* session)
(setf (gethash *csrf-token-key* session) (generate-random-id)))
(gethash *csrf-token-key* session))
(unless (gethash *csrf-session-key* session)
(setf (gethash *csrf-session-key* session) (generate-random-id)))
(gethash *csrf-session-key* session))
(defun csrf-html-tag (session)
(format nil "<input type=\"hidden\" name=\"_csrf_token\" value=\"~A\">"