express-user - npm Package Compare versions

Comparing version 0.0.1-alpha.9 to 0.0.1-alpha.10

example/Example.js

@@ -5,5 +5,7 @@ //Copyright (c) 2015 Eric Vallee <[e-mail]>
 var Http = require('http');
+var Path = require('path');
+
 var Express = require('express');
-var Path = require('path');
 var BodyParser = require('body-parser');
+var Csrf = require('csurf');
 
@@ -28,5 +30,9 @@ var MongoDB = require('mongodb');
 var ExpressBruteOptions = {'freeRetries': 10, 'minWait': Wait, 'maxWait': Wait, 'lifetime': 60*60, 'refreshTimeoutOnRequest': false};
+
 var StaticPath = Path.resolve(__dirname, 'Static');
-var Index = Path.resolve(Path.resolve(__dirname, "Views"), "Index.html");
+App.set("view engine", "ejs");
+App.set("views", Path.resolve(__dirname, "Views"));
 
+var CsrfRoute = Csrf({ cookie: false });
+
 MongoDB.MongoClient.connect("mongodb://localhost:27017/"+RandomIdentifier, {native_parser:true}, function(Err, DB) {
@@ -36,3 +42,3 @@ DB.createCollection('PasswordAccess', {'w': 1}, function(Err, BruteCollection) {
         var ExpressBrute = new ExpressBruteAPI(BruteStore, ExpressBruteOptions);
-        var ExpressUserLocalOptions = {'BruteForceRoute': ExpressBrute.prevent};
+        var ExpressUserLocalOptions = {'BruteForceRoute': ExpressBrute.prevent, 'CsrfRoute': CsrfRoute};
         UserStoreAPI(DB, {'Email': {'Unique': 1, 'NotNull': 1}, 'Username': {'Unique': 1, 'NotNull': 1}, 'Password': {'NotNull': 1}}, function(Err, UserStore) {
@@ -95,6 +101,19 @@ SessionStoreAPI(DB, function(Err, SessionStore) {
                 
-                App.get('/', function(Req,Res) {
-                    Res.sendFile(Index);
+                App.get('/', CsrfRoute);
+                App.get('/', function(Req, Res) {
+                    Res.render("Index", {'CsrfToken': Req.csrfToken()});
                 });
                 
+                App.use('/', function(Err, Req, Res, Next) {
+                    if(Err.code !== 'EBADCSRFTOKEN') 
+                    {
+                        next(Err);
+                        return;
+                    }
+                    else
+                    {
+                        Res.status(403).end();
+                    }
+                });
+                
                 Http.createServer(App).listen(8080);
@@ -101,0 +120,0 @@ }, SessionStoreOptions);

example/Static/ClientLogic.js

@@ -24,2 +24,7 @@ //Copyright (c) 2015 Eric Vallee <[e-mail]>
     });
+    var Csrf = this.children('input[name=_csrf]');
+    Csrf.each(function(Index, Element) {
+        var WrappedElement = jQuery(Element);
+        ToReturn[WrappedElement.attr('name')] = WrappedElement.val();
+    });
     return ToReturn;
@@ -26,0 +31,0 @@ }

package.json

 {
   "name": "express-user",
-  "version": "0.0.1-alpha.9",
+  "version": "0.0.1-alpha.10",
   "description": "Ressource Oriented Express Middleware to Manage Users.",
@@ -40,3 +40,5 @@ "keywords": [
     "express-brute": "~0.5.2",
-    "express-brute-mongo": "~0.1.0"
+    "express-brute-mongo": "~0.1.0",
+    "csurf": "~1.7.0",
+    "ejs": "~2.2.4"
   },
@@ -43,0 +45,0 @@ "license": "MIT",

README.md

@@ -233,1 +233,7 @@ Express-User
 - Updated the client-side of the example to changes made to express-user-local.
+
+0.0.1-alpha.10
+--------------
+
+- Updated dev dependency of express-user-local to 0.0.1-alpha.7.
+- Modified example (client and server) to include csrf mitigation.

New alerts

License Policy Violation

License

This package is not allowed per your license policy. Review the package's license to ensure compliance.

Found 1 instance in 1 package

Fixed alerts

License Policy Violation

License

This package is not allowed per your license policy. Review the package's license to ensure compliance.

Found 1 instance in 1 package

Improved metrics

Total package byte prevSize

79710

increased by8.85%

Number of package files

17

increased by6.25%

Lines of code

522

increased by3.98%

Number of lines in readme file

239

increased by2.58%

Worsened metrics

Dev dependency count

12

increased by20%

No dependency changes