3405c1e2cc
Only SameSite=Lax protected the acknowledge and zone save/delete endpoints, even though a Csrf helper and mintable token already existed. Add GET /api/csrf (CsrfController::token) to mint/return a per-session token, check it (auth -> rbac -> csrf -> mutate) in EventDetailController::acknowledge and ZoneConfigController::save/delete, and wire app.js/zone-draw.js to fetch the token on load and send it as X-Csrf-Token on every POST.
19 lines
501 B
PHP
19 lines
501 B
PHP
<?php
|
|
declare(strict_types=1);
|
|
namespace App\Auth;
|
|
|
|
use App\Http\{Request, Response};
|
|
|
|
final class CsrfController
|
|
{
|
|
public function token(Request $req, SessionStore $sess): Response
|
|
{
|
|
if ($sess->get('user_id') === null) {
|
|
return Response::json(['error' => 'unauthorized'], 401);
|
|
}
|
|
if ($sess->get('csrf') === null) {
|
|
$sess->set('csrf', bin2hex(random_bytes(32)));
|
|
}
|
|
return Response::json(['token' => $sess->get('csrf')]);
|
|
}
|
|
}
|