Replaced decprecated csurf module with csrf-csrf.

Fixes #34.
Note: this introduces a breaking change in the way CSRF tokens are transmitted. To get the old less secure behaviour back you can set the environment variable SEND-CSRF-COOKIE. This will cause a client side cookie to be set and the ui/csrf-token function will then be able to be used. See the README for more details: https://github.com/chr15m/sitefox/#csrf-protection

README.md

@@ -415,25 +415,37 @@ Also see the [send-email example](https://github.com/chr15m/sitefox/tree/main/ex
 
 See the [form validation example](https://github.com/chr15m/sitefox/tree/main/examples/form-validation) which uses [node-input-validator](https://www.npmjs.com/package/node-input-validator) and checks for CSRF problems.
 
+#### CSRF protection
+
 To ensure you can `POST` without CSRF warnings you should create a hidden element like this (Reagent syntax):
 
 ```clojure
 [:input {:name "_csrf" :type "hidden" :default-value (.csrfToken req)}]
 ```
 
-If you're making an ajax `POST` request from the client side, you should pass the CSRF token as a header. A valid token is available in the document's cookie and you can add it to the headers of a fetch request as follows:
+If you're making an ajax `POST` request from the client side, you should pass the CSRF token as a header.
+A valid token is available as a string at the JSON endpoint `/_csrf-token` and you can fetch it using `fetch-csrf-token`
+and add it to the headers of a fetch request as follows:
 
 ```clojure
-(ns n (:require [sitefox.ui :refer [csrf-token]]))
+(ns n (:require [sitefox.ui :refer [fetch-csrf-token]]))
 
-(js/fetch "/api/endpoint"
-          #js {:method "POST"
-               :headers #js {:Content-Type "application/json"
-                             :XSRF-Token (csrf-token)}
-               :body (js/JSON.stringify (clj->js data))})
+(-> (fetch-csrf-token)
+    (.then (fn [token]
+             (js/fetch "/api/endpoint"
+                       #js {:method "POST"
+                            :headers #js {:Content-Type "application/json"
+                                          :X-XSRF-TOKEN token} ; <- use token here
+                            :body (js/JSON.stringify (clj->js some-data))}))))
 ```
 
-In some rare circumstances you may wish to turn off CSRF checking (for example posting to an API from a non-browser device).
+**Note**: you can fetch the CSRF token from a client side cookie instead if you set the environment variable `SEND-CSRF-TOKEN`.
+This was the default in previous Sitefox versions.
+When set, Sitefox will send the token on every GET request in the client side cookie
+`XSRF-TOKEN` and this can be retrieved with the `ui/csrf-token` function.
+This is a valid, but less secure form of CSRF protection.
+
+In some rare circumstances you may wish to turn off CSRF checks (for example posting to an API from a non-browser device).
 If you know what you are doing you can use the `pre-csrf-router` to add routes which bypass the CSRF checking:
 
 ```clojure

examples/form-validation/webserver.cljs

@@ -23,12 +23,15 @@
 
 (def button-script
   (str
-  "token=document.cookie.split('; ')
-  .find((row)=>row.startsWith('XSRF-TOKEN='))?.split('=')[1];
-  ajax.onclick=()=>{fetch('/ajax',
-                {'method':'POST','body':'received!',
-                 'headers':{'Content-Type':'text/plain','XSRF-Token':token}})
-                .then(r=>r.text()).then(d=>{ajaxresult.innerHTML=d})}"))
+    "ajax.onclick=()=>{
+       fetch('/_csrf-token').then(r=>r.json()).then((token)=>{
+         console.log('token: ', token);
+         fetch('/ajax',
+           {'method':'POST','body':'received!',
+            'headers':{'Content-Type':'text/plain','X-XSRF-TOKEN':token}}
+         ).then(r=>r.text()).then(d=>{ajaxresult.innerHTML=d})
+       });
+    }"))
 
 (defn view:form [csrf-token data validation-errors]
   (let [ve (or validation-errors #js {})

src/sitefox/ui.cljs

@@ -65,7 +65,7 @@
   (second (re-find (js/RegExp. (str cookie-name "=([^;]+)")) (or cookies (aget js/document "cookie")))))
 
 (defn csrf-token
-  "Returns the CSRF token passed by Sitefox in the `XSRF-TOKEN` header.
+  "Returns the CSRF token passed by Sitefox in the `XSRF-TOKEN` cookie.
    Pass this value when doing POST requests via ajax:
 
    ```clojure
@@ -75,6 +75,31 @@
                                 :XSRF-Token (csrf-token)}
                                 :body (js/JSON.stringify (clj->js data))})
    ```
+
+   **Note**: passing the token via client side cookie is now deprecated.
+   If you want to re-enable it set the client side environment variable `SEND-CSRF-COOKIE`,
+   and then this function will work again.
+
+   See the README for more details: <https://github.com/chr15m/sitefox/#csrf-protection>
   "
   []
   (get-cookie "XSRF-TOKEN"))
+
+(defn fetch-csrf-token
+  "Returns a promise which resolves to a string containing the CSRF token fetched from the Sitefox backend server.
+  Pass this value as the X-XSRF-TOKEN when doing POST requests via ajax fetch:
+  
+  ```clojure
+    (-> (fetch-csrf-token)
+        (.then (fn [token]
+                 (js/fetch \"/api/endpoint\"
+                           #js {:method \"POST\"
+                                :headers #js {:Content-Type \"application/json\"
+                                              :X-XSRF-TOKEN token} ; <- use token here
+                                :body (js/JSON.stringify (clj->js some-data))}))))
+  ```
+  "
+  []
+  (->
+    (js/fetch "/_csrf-token")
+    (.then #(.json %))))

src/sitefox/web.cljs

@@ -78,25 +78,23 @@
   (let [pre-csrf-router (Router.)]
     (.use app pre-csrf-router)
     (j/assoc! app :pre-csrf-router pre-csrf-router))
-  (.post app (fn [req _res done]
-               (print "x-csrf-token"
-                      (j/get req [:headers :x-csrf-token]))
-               (done)))
-  ;(.get app "/_csrf-token" (fn [req res] (.json res generateToken)))
   (.use app (j/get (csrf #js {:getSecret (fn [] (env "SECRET" "DEVMODE"))
                               :cookieOptions #js {:httpOnly true :sameSite "Strict" :secure true}
                               :size 32
                               :cookieName "XSRF-TOKEN"
                               :getTokenFromRequest (fn [req]
-                                                     (print "getTokenFromRequest")
-                                                     (js/console.log "check csrf body:" (j/get-in req [:body :_csrf]))
-                                                     (js/console.log "check csrf header:" (j/get-in req [:header :XSRF-TOKEN]))
-                                                     (js/console.log "check csrf cookie:" (-> (j/get-in req [:cookies :XSRF-TOKEN]) (.split "|") first))
                                                      (or (j/get-in req [:body :_csrf])
-                                                         (j/get-in req [:headers :XSRF-TOKEN])
-                                                         (-> (j/get-in req [:cookies :XSRF-TOKEN]) (.split "|") first)))})
+                                                         (j/call req :get "xsrf-token")
+                                                         (j/call req :get "x-xsrf-token")))})
                    :doubleCsrfProtection))
-  ;(.use app (fn [req res done] (j/call res :cookie "XSRF-TOKEN" (j/call req :csrfToken) #js {:secure true :sameSite "Strict"}) (done)))
+  (.get app "/_csrf-token"
+        (fn [req res]
+          (.json res (j/call req :csrfToken))))
+  (when (env "SEND-CSRF-COOKIE")
+    (.get app (fn [req res done]
+                (j/call res :cookie "XSRF-TOKEN" (j/call req :csrfToken)
+                        #js {:secure true :sameSite "Strict"})
+                (done))))
   app)
 
 (defn static-folder

src/sitefoxtest/e2etests.cljs

@@ -359,5 +359,5 @@
                  (done))
                #(catch-fail % done server browser))))))
 
-; (t/run-test sitefoxtest.e2etests/nbb-forms)
+;(t/run-test sitefoxtest.e2etests/nbb-forms)
 (t/run-tests *ns*)