paulononato/backstage
1
0
Fork 0
Code Issues Pull Requests Actions 21 Packages Projects Releases Wiki Activity

auth-node: inline ensuresXRequestedWith

Browse Source 
Signed-off-by: Patrik Oldsberg <poldsberg@gmail.com>
This commit is contained in:
Patrik Oldsberg
2023-07-26 14:30:03 +02:00
parent 679239161d
commit ac8f47aa69
1 changed files with 5 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files
plugins/auth-node/src/oauth/createOAuthHandlers.ts
+5 -3
View File
@@ -24,7 +24,7 @@ import {
NotAllowedError,
} from '@backstage/errors';
import { defaultStateDecoder, defaultStateEncoder, OAuthState } from './state';
import { postMessageResponse, ensuresXRequestedWith } from '../flow';
import { postMessageResponse } from '../flow';
import { prepareBackstageIdentityResponse } from '../identity';
import { OAuthCookieManager } from './OAuthCookieManager';
import {
@@ -259,7 +259,8 @@ export function createOAuthHandlers<TProfile>(
req: express.Request,
res: express.Response,
): Promise<void> {
if (!ensuresXRequestedWith(req)) {
// We use this as a lightweight CSRF protection
if (req.header('X-Requested-With') !== 'XMLHttpRequest') {
throw new AuthenticationError('Invalid X-Requested-With header');
}
@@ -279,7 +280,8 @@ export function createOAuthHandlers<TProfile>(
req: express.Request,
res: express.Response,
): Promise<void> {
if (!ensuresXRequestedWith(req)) {
// We use this as a lightweight CSRF protection
if (req.header('X-Requested-With') !== 'XMLHttpRequest') {
throw new AuthenticationError('Invalid X-Requested-With header');
}