Skip to content

Commit fc117f7

Browse files
committed
feat: decouple from express for improved framework support
This attempts to remove explicit Express dependencies from csrf-csrf. TypeScript support updated to make use of generics which rely on the underlying Node types instead.
1 parent 58a0cdd commit fc117f7

File tree

11 files changed

+263
-62
lines changed

11 files changed

+263
-62
lines changed

example/complete/package.json

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -12,7 +12,7 @@
1212
"license": "ISC",
1313
"dependencies": {
1414
"cookie-parser": "^1.4.6",
15-
"csrf-csrf": "4.0.0",
15+
"csrf-csrf": "../../csrf-csrf-4.0.0.tgz",
1616
"express": "^4.19.2",
1717
"express-session": "1.18.1"
1818
}

example/react/backend/package.json

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -24,7 +24,7 @@
2424
"connect-redis": "8.0.3",
2525
"cookie-parser": "1.4.7",
2626
"cors": "2.8.5",
27-
"csrf-csrf": "4.0.0",
27+
"csrf-csrf": "../../../csrf-csrf-4.0.0.tgz",
2828
"ejs": "3.1.10",
2929
"express": "5.1.0",
3030
"express-session": "1.18.1",

example/react/backend/src/config/csrf.ts

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,6 @@
11
import { doubleCsrf } from "csrf-csrf";
22
import { EXAMPLE_CSRF_SECRET, IS_PRODUCTION } from "./constants.js";
3+
import type { Request, Response } from "express";
34

45
/*
56
* This configuration is for the React SPA.
@@ -10,7 +11,7 @@ import { EXAMPLE_CSRF_SECRET, IS_PRODUCTION } from "./constants.js";
1011
*
1112
* Please note that with the default options secure is set to true in this configuration
1213
*/
13-
export const { doubleCsrfProtection, invalidCsrfTokenError, generateCsrfToken } = doubleCsrf({
14+
export const { doubleCsrfProtection, invalidCsrfTokenError, generateCsrfToken } = doubleCsrf<Request, Response>({
1415
getSecret: () => EXAMPLE_CSRF_SECRET,
1516
getSessionIdentifier: (req) => {
1617
// If you were using a JWT as a httpOnly cookie, you would return that here instead

example/react/backend/src/index.ts

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
import cookieParser from "cookie-parser";
22
import type { CsrfTokenGeneratorRequestUtil } from "csrf-csrf";
3-
import Express from "express";
3+
import Express, { type Request, type Response } from "express";
44
import { EXAMPLE_API_PORT } from "./config/constants.js";
55
import cors from "./config/cors.js";
66
import { doubleCsrfProtection, generateCsrfToken } from "./config/csrf.js";
@@ -30,7 +30,7 @@ app.get("/csrf-token", (req, res) => {
3030
app.get("/csrf-token-util", (req, res) => {
3131
// This is just a demonstration doing the same thing as the previous route
3232
// The type casting here is "safe" as we know this is guaranteed to be after the doubleCsrfProtection middleware
33-
const csrfToken = (req.csrfToken as CsrfTokenGeneratorRequestUtil)();
33+
const csrfToken = (req.csrfToken as CsrfTokenGeneratorRequestUtil<Request, Response>)();
3434
res.status(200).json({ csrfToken });
3535
});
3636

example/tinyhttp/package.json

Lines changed: 21 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,21 @@
1+
{
2+
"name": "csrf-csrf-tinyhttp-example",
3+
"version": "1.0.0",
4+
"main": "index.js",
5+
"scripts": {
6+
"test": "echo \"Error: no test specified\" && exit 1"
7+
},
8+
"author": "psibean",
9+
"license": "ISC",
10+
"description": "",
11+
"dependencies": {
12+
"@tinyhttp/app": "latest",
13+
"@tinyhttp/cookie-parser": "2.0.6",
14+
"@tinyhttp/logger": "latest",
15+
"csrf-csrf": "file:../../csrf-csrf-4.0.0.tgz"
16+
},
17+
"devDependencies": {
18+
"@tinyhttp/cli": "1.3.7",
19+
"typescript": "5.8.3"
20+
}
21+
}

example/tinyhttp/src/index.ts

Lines changed: 33 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,33 @@
1+
import { App } from "@tinyhttp/app";
2+
import { logger } from "@tinyhttp/logger";
3+
import { cookieParser } from "@tinyhttp/cookie-parser";
4+
import { doubleCsrf } from "csrf-csrf";
5+
6+
const app = new App();
7+
const { doubleCsrfProtection } = doubleCsrf({
8+
getSecret: () => "some secret",
9+
getSessionIdentifier: () => "some session id",
10+
});
11+
12+
app
13+
.use(logger())
14+
.use(cookieParser())
15+
.use(doubleCsrfProtection)
16+
.get(
17+
"/",
18+
(_, res) =>
19+
void res.format({
20+
html: () => res.send("<h1>Hello World</h1>"),
21+
text: () => res.send("Hello World"),
22+
}),
23+
)
24+
.get("/page/:page/", (req, res, next) => {
25+
res.status(200).send(`
26+
<h1>Some cool page</h1>
27+
<h2>URL</h2>
28+
${req.url}
29+
<h2>Params</h2>
30+
${JSON.stringify(req.params, null, 2)}
31+
`);
32+
})
33+
.listen(3000, () => console.log("Listening on http://localhost:3000"));

example/tinyhttp/tsconfig.json

Lines changed: 110 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,110 @@
1+
{
2+
"compilerOptions": {
3+
/* Visit https://aka.ms/tsconfig to read more about this file */
4+
5+
/* Projects */
6+
// "incremental": true, /* Save .tsbuildinfo files to allow for incremental compilation of projects. */
7+
// "composite": true, /* Enable constraints that allow a TypeScript project to be used with project references. */
8+
// "tsBuildInfoFile": "./.tsbuildinfo", /* Specify the path to .tsbuildinfo incremental compilation file. */
9+
// "disableSourceOfProjectReferenceRedirect": true, /* Disable preferring source files instead of declaration files when referencing composite projects. */
10+
// "disableSolutionSearching": true, /* Opt a project out of multi-project reference checking when editing. */
11+
// "disableReferencedProjectLoad": true, /* Reduce the number of projects loaded automatically by TypeScript. */
12+
13+
/* Language and Environment */
14+
"target": "ES2023" /* Set the JavaScript language version for emitted JavaScript and include compatible library declarations. */,
15+
// "lib": [], /* Specify a set of bundled library declaration files that describe the target runtime environment. */
16+
// "jsx": "preserve", /* Specify what JSX code is generated. */
17+
// "experimentalDecorators": true, /* Enable experimental support for legacy experimental decorators. */
18+
// "emitDecoratorMetadata": true, /* Emit design-type metadata for decorated declarations in source files. */
19+
// "jsxFactory": "", /* Specify the JSX factory function used when targeting React JSX emit, e.g. 'React.createElement' or 'h'. */
20+
// "jsxFragmentFactory": "", /* Specify the JSX Fragment reference used for fragments when targeting React JSX emit e.g. 'React.Fragment' or 'Fragment'. */
21+
// "jsxImportSource": "", /* Specify module specifier used to import the JSX factory functions when using 'jsx: react-jsx*'. */
22+
// "reactNamespace": "", /* Specify the object invoked for 'createElement'. This only applies when targeting 'react' JSX emit. */
23+
// "noLib": true, /* Disable including any library files, including the default lib.d.ts. */
24+
// "useDefineForClassFields": true, /* Emit ECMAScript-standard-compliant class fields. */
25+
// "moduleDetection": "auto", /* Control what method is used to detect module-format JS files. */
26+
27+
/* Modules */
28+
"module": "NodeNext" /* Specify what module code is generated. */,
29+
"rootDir": "./src" /* Specify the root folder within your source files. */,
30+
"moduleResolution": "NodeNext" /* Specify how TypeScript looks up a file from a given module specifier. */,
31+
// "baseUrl": "./", /* Specify the base directory to resolve non-relative module names. */
32+
// "paths": {}, /* Specify a set of entries that re-map imports to additional lookup locations. */
33+
// "rootDirs": [], /* Allow multiple folders to be treated as one when resolving modules. */
34+
"typeRoots": ["node_modules/@types"] /* Specify multiple folders that act like './node_modules/@types'. */,
35+
// "types": [], /* Specify type package names to be included without being referenced in a source file. */
36+
// "allowUmdGlobalAccess": true, /* Allow accessing UMD globals from modules. */
37+
// "moduleSuffixes": [], /* List of file name suffixes to search when resolving a module. */
38+
// "allowImportingTsExtensions": true, /* Allow imports to include TypeScript file extensions. Requires '--moduleResolution bundler' and either '--noEmit' or '--emitDeclarationOnly' to be set. */
39+
// "resolvePackageJsonExports": true, /* Use the package.json 'exports' field when resolving package imports. */
40+
// "resolvePackageJsonImports": true, /* Use the package.json 'imports' field when resolving imports. */
41+
// "customConditions": [], /* Conditions to set in addition to the resolver-specific defaults when resolving imports. */
42+
// "noUncheckedSideEffectImports": true, /* Check side effect imports. */
43+
// "resolveJsonModule": true, /* Enable importing .json files. */
44+
// "allowArbitraryExtensions": true, /* Enable importing files with any extension, provided a declaration file is present. */
45+
// "noResolve": true, /* Disallow 'import's, 'require's or '<reference>'s from expanding the number of files TypeScript should add to a project. */
46+
47+
/* JavaScript Support */
48+
// "allowJs": true, /* Allow JavaScript files to be a part of your program. Use the 'checkJS' option to get errors from these files. */
49+
// "checkJs": true, /* Enable error reporting in type-checked JavaScript files. */
50+
// "maxNodeModuleJsDepth": 1, /* Specify the maximum folder depth used for checking JavaScript files from 'node_modules'. Only applicable with 'allowJs'. */
51+
52+
/* Emit */
53+
"declaration": false /* Generate .d.ts files from TypeScript and JavaScript files in your project. */,
54+
// "declarationMap": true, /* Create sourcemaps for d.ts files. */
55+
// "emitDeclarationOnly": true, /* Only output d.ts files and not JavaScript files. */
56+
// "sourceMap": true, /* Create source map files for emitted JavaScript files. */
57+
// "inlineSourceMap": true, /* Include sourcemap files inside the emitted JavaScript. */
58+
// "noEmit": true, /* Disable emitting files from a compilation. */
59+
// "outFile": "./", /* Specify a file that bundles all outputs into one JavaScript file. If 'declaration' is true, also designates a file that bundles all .d.ts output. */
60+
"outDir": "./dist" /* Specify an output folder for all emitted files. */,
61+
"removeComments": true /* Disable emitting comments. */,
62+
// "importHelpers": true, /* Allow importing helper functions from tslib once per project, instead of including them per-file. */
63+
// "downlevelIteration": true, /* Emit more compliant, but verbose and less performant JavaScript for iteration. */
64+
// "sourceRoot": "", /* Specify the root path for debuggers to find the reference source code. */
65+
// "mapRoot": "", /* Specify the location where debugger should locate map files instead of generated locations. */
66+
// "inlineSources": true, /* Include source code in the sourcemaps inside the emitted JavaScript. */
67+
// "emitBOM": true, /* Emit a UTF-8 Byte Order Mark (BOM) in the beginning of output files. */
68+
// "newLine": "crlf", /* Set the newline character for emitting files. */
69+
// "stripInternal": true, /* Disable emitting declarations that have '@internal' in their JSDoc comments. */
70+
// "noEmitHelpers": true, /* Disable generating custom helper functions like '__extends' in compiled output. */
71+
// "noEmitOnError": true, /* Disable emitting files if any type checking errors are reported. */
72+
// "preserveConstEnums": true, /* Disable erasing 'const enum' declarations in generated code. */
73+
// "declarationDir": "./", /* Specify the output directory for generated declaration files. */
74+
75+
/* Interop Constraints */
76+
// "isolatedModules": true, /* Ensure that each file can be safely transpiled without relying on other imports. */
77+
// "verbatimModuleSyntax": true, /* Do not transform or elide any imports or exports not marked as type-only, ensuring they are written in the output file's format based on the 'module' setting. */
78+
// "isolatedDeclarations": true, /* Require sufficient annotation on exports so other tools can trivially generate declaration files. */
79+
// "allowSyntheticDefaultImports": true, /* Allow 'import x from y' when a module doesn't have a default export. */
80+
"esModuleInterop": true /* Emit additional JavaScript to ease support for importing CommonJS modules. This enables 'allowSyntheticDefaultImports' for type compatibility. */,
81+
// "preserveSymlinks": true, /* Disable resolving symlinks to their realpath. This correlates to the same flag in node. */
82+
"forceConsistentCasingInFileNames": true /* Ensure that casing is correct in imports. */,
83+
84+
/* Type Checking */
85+
"strict": true /* Enable all strict type-checking options. */,
86+
// "noImplicitAny": true, /* Enable error reporting for expressions and declarations with an implied 'any' type. */
87+
// "strictNullChecks": true, /* When type checking, take into account 'null' and 'undefined'. */
88+
// "strictFunctionTypes": true, /* When assigning functions, check to ensure parameters and the return values are subtype-compatible. */
89+
// "strictBindCallApply": true, /* Check that the arguments for 'bind', 'call', and 'apply' methods match the original function. */
90+
// "strictPropertyInitialization": true, /* Check for class properties that are declared but not set in the constructor. */
91+
// "strictBuiltinIteratorReturn": true, /* Built-in iterators are instantiated with a 'TReturn' type of 'undefined' instead of 'any'. */
92+
// "noImplicitThis": true, /* Enable error reporting when 'this' is given the type 'any'. */
93+
// "useUnknownInCatchVariables": true, /* Default catch clause variables as 'unknown' instead of 'any'. */
94+
// "alwaysStrict": true, /* Ensure 'use strict' is always emitted. */
95+
// "noUnusedLocals": true, /* Enable error reporting when local variables aren't read. */
96+
// "noUnusedParameters": true, /* Raise an error when a function parameter isn't read. */
97+
// "exactOptionalPropertyTypes": true, /* Interpret optional property types as written, rather than adding 'undefined'. */
98+
// "noImplicitReturns": true, /* Enable error reporting for codepaths that do not explicitly return in a function. */
99+
// "noFallthroughCasesInSwitch": true, /* Enable error reporting for fallthrough cases in switch statements. */
100+
// "noUncheckedIndexedAccess": true, /* Add 'undefined' to a type when accessed using an index. */
101+
// "noImplicitOverride": true, /* Ensure overriding members in derived classes are marked with an override modifier. */
102+
// "noPropertyAccessFromIndexSignature": true, /* Enforces using indexed accessors for keys declared using an indexed type. */
103+
// "allowUnusedLabels": true, /* Disable error reporting for unused labels. */
104+
// "allowUnreachableCode": true, /* Disable error reporting for unreachable code. */
105+
106+
/* Completeness */
107+
// "skipDefaultLibCheck": true, /* Skip type checking .d.ts files that are included with TypeScript. */
108+
"skipLibCheck": true /* Skip type checking all .d.ts files. */
109+
}
110+
}

0 commit comments

Comments
 (0)