2386919998
CRITICAL SECURITY FIX - Prevents Cross-Site Request Forgery attacks Changes: - Installed csurf middleware (session-based tokens) - Added CSRF middleware to all /admin routes in src/index.js - Configured admin router to pass csrfToken to all views - Updated layout.ejs to send CSRF token with htmx requests - Added EJS view engine configuration - Added body parsing middleware (json + urlencoded) Security Impact: - Prevents malicious sites from executing admin actions using cookies - All POST requests now require valid CSRF token - Invalid tokens return 403 Forbidden - Session-based tokens (no cookies needed) Protected Routes: - /admin/servers/:id/sync (force whitelist sync) - /admin/servers/:id/toggle-whitelist (whitelist toggle) - /admin/grace/:id/extend (grace period extension) - /admin/grace/:id/manual (manual payment override) - /admin/roles/resync/:id (role assignment) Attack Scenario Prevented: User visits malicious site while logged into Trinity Console → Site tries to submit form to admin endpoint → Request includes session cookie but NO CSRF token → Server rejects with 403 Forbidden → Attack failed! Note: csurf is deprecated but still functional. For future refactor, consider csrf-csrf or Express 5 built-in protection. Refs: TRINITY-CONSOLE-PRE-LAUNCH-CHECKLIST.md - Fix #1 Chronicler: #51 Signed-off-by: Claude (Chronicler #51) <claude@firefrostgaming.com>
25 lines
593 B
JSON
25 lines
593 B
JSON
{
|
|
"name": "arbiter-3.0",
|
|
"version": "3.0.0",
|
|
"description": "Modular Access & Role Manager with Trinity Console",
|
|
"main": "src/index.js",
|
|
"scripts": {
|
|
"start": "node src/index.js",
|
|
"dev": "node --watch src/index.js"
|
|
},
|
|
"dependencies": {
|
|
"body-parser": "^1.20.2",
|
|
"cookie-parser": "^1.4.7",
|
|
"csurf": "^1.11.0",
|
|
"discord.js": "^14.14.1",
|
|
"dotenv": "^16.4.5",
|
|
"ejs": "^3.1.9",
|
|
"express": "^4.18.2",
|
|
"express-session": "^1.19.0",
|
|
"node-cron": "^3.0.3",
|
|
"passport": "^0.7.0",
|
|
"passport-discord": "^0.1.4",
|
|
"pg": "^8.11.3"
|
|
}
|
|
}
|