mindol1004/getting-started
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

added code

Browse Source
This commit is contained in:
Pratik Das
2021-07-22 15:14:26 +05:30
parent 406a57d203
commit 3c934fd394
5 changed files with 80 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

3
cors/README.md Normal file
View File

@@ -0,0 +1,3 @@
# Related Blog Posts
* [Complete guide to CORS](https://reflectoring.io/complete-guide-to-cors/)

3
csrf/README.md Normal file
View File

@@ -0,0 +1,3 @@
# Related Blog Posts
* [Complete guide to CSRF](https://reflectoring.io/complete-guide-to-csrf/)

28
csrf/index.js Normal file
View File

@@ -0,0 +1,28 @@
const express = require('express');
const csrf = require('csurf');
const cookieParser = require('cookie-parser');
var csrfProtection = csrf({ cookie: true });
var parseForm = express.urlencoded({ extended: false });
var app = express();
app.set('view engine','ejs')
app.use(cookieParser());
app.get('/transfer', csrfProtection, function (req, res) {
// pass the csrfToken to the view
res.render('transfer', { csrfToken: req.csrfToken() });
});
app.post('/process', parseForm,
csrfProtection, function (req, res) {
res.send('Transfer Successful!!');
});
app.listen(3000, (err) => {
if (err) console.log(err);
console.log('Server listening on 3000');
}
);

23
csrf/package.json Normal file
View File

@@ -0,0 +1,23 @@
{
"name": "csrfapp",
"version": "1.0.0",
"description": "CSRF mitigation example",
"main": "index.js",
"scripts": {
"test": "echo \"Error: no test specified\" && exit 1"
},
"keywords": [
"csrf"
],
"author": "Pratik Das",
"license": "ISC",
"dependencies": {
"body-parser": "^1.19.0",
"cookie-parser": "^1.4.5",
"cookie-session": "^1.4.0",
"csurf": "^1.11.0",
"ejs": "^3.1.6",
"express": "^4.17.1",
"pug": "^3.0.2"
}
}

23
csrf/views/transfer.ejs Normal file
View File

@@ -0,0 +1,23 @@
<html>
<head>
<title>CSRF Token Demo</title>
</head>
<body>
<form action="process" method="POST">
<input type="hidden" name="_csrf" value="<%= csrfToken %>">
<div>
<label>Amount:</label><input type="text" name="amount">
</div>
<br/>
<div>
<label>Transfer To:</label><input type="text" name="account">
</div>
<br/>
<div>
<input type="submit" value="Transfer">
</div>
</form>
</body>
</html>