Erik Michelson 66d052d611 feat(security): add CSRF protection to private API endpoints ...

This adds a new endpoint /api/private/csrf/token which serves a CSRF-token that
is stored in the user's session. Following requests with POST, PUT, PATCH or DELETE
request methods, need to provide this token in the CSRF-Token header. Since this
is not possible to do via HTML forms or other cross-site effects, this prevents
cross-site attacks. The frontend loads the CSRF token on app initialization and
stores it in the redux. It keeps using the token for up to one hour and then
updates the stored token from the API endpoint again.

Signed-off-by: Erik Michelson <github@erik.michelson.eu>

2026-02-04 21:36:52 +01:00

..

src

feat(security): add CSRF protection to private API endpoints

2026-02-04 21:36:52 +01:00

types

refactor: reorganize files in commons package

2023-05-31 23:42:46 +02:00

.gitignore

feat(packages): add commons package

2022-12-11 23:09:10 +01:00

.npmignore

feat(packages): add commons package

2022-12-11 23:09:10 +01:00

.npmignore.license

feat(packages): add commons package

2022-12-11 23:09:10 +01:00

.oxfmtrc.json

chore(format): migrate from prettier to oxfmt

2026-01-14 19:46:27 +01:00

.oxfmtrc.json.license

chore(format): reformat using oxfmt

2026-01-14 19:46:27 +01:00

.oxlintrc.json

chore(lint): replace ESLint with OXLint for performance

2026-01-14 19:46:27 +01:00

.oxlintrc.json.license

chore(lint): replace ESLint with OXLint for performance

2026-01-14 19:46:27 +01:00

.prettierignore.license

feat(packages): add commons package

2022-12-11 23:09:10 +01:00

build.sh

fix: use sh instead of bash in build scripts

2023-08-27 12:42:40 +02:00

jest.config.json

fix(test): remove warning about isolatedModules in ts-jest diagnostics

2026-01-12 18:34:31 +01:00

jest.config.json.license

feat(packages): add commons package

2022-12-11 23:09:10 +01:00

package.json

chore(format): migrate from prettier to oxfmt

2026-01-14 19:46:27 +01:00

package.json.license

feat(packages): add commons package

2022-12-11 23:09:10 +01:00

tsconfig.base.json

fix(commons): replace microbundle with bash based compile script

2023-07-30 14:56:29 +02:00

tsconfig.base.json.license

fix(commons): replace microbundle with bash based compile script

2023-07-30 14:56:29 +02:00

tsconfig.cjs.json

fix(commons): replace microbundle with bash based compile script

2023-07-30 14:56:29 +02:00

tsconfig.cjs.json.license

fix(commons): replace microbundle with bash based compile script

2023-07-30 14:56:29 +02:00

tsconfig.esm.json

fix(commons): migrate typescript config

2023-08-26 11:40:09 +02:00

tsconfig.esm.json.license

fix(commons): replace microbundle with bash based compile script

2023-07-30 14:56:29 +02:00

tsconfig.test.json

fix(commons): replace microbundle with bash based compile script

2023-07-30 14:56:29 +02:00

tsconfig.test.json.license

fix(commons): replace microbundle with bash based compile script

2023-07-30 14:56:29 +02:00