fix: reject RPC requests without CSRF tokens

2026-08-12 19:49:58 +05:30
parent f68f79786f
commit afe1c413cc
5 changed files with 53 additions and 16 deletions
@@ -0,0 +1,36 @@
+import { expect, test } from "bun:test";
+import { validateRpcCsrf } from "../src/index.ts";
+
+function request(headers: Record<string, string> = {}): Request {
+  return new Request("https://app.example/__wrnexus/rpc", {
+    method: "POST",
+    headers,
+  });
+}
+
+test("RPC CSRF requires a matching cookie and header from the same origin", () => {
+  expect(validateRpcCsrf(request())).toBe(false);
+  expect(validateRpcCsrf(request({ cookie: "wrn-csrf=token" }))).toBe(false);
+  expect(validateRpcCsrf(request({ "x-csrf-token": "token" }))).toBe(false);
+  expect(validateRpcCsrf(request({ cookie: "wrn-csrf=token", "x-csrf-token": "forged" }))).toBe(
+    false,
+  );
+  expect(
+    validateRpcCsrf(
+      request({
+        cookie: "wrn-csrf=token",
+        "x-csrf-token": "token",
+        origin: "https://evil.example",
+      }),
+    ),
+  ).toBe(false);
+  expect(
+    validateRpcCsrf(
+      request({
+        cookie: "wrn-csrf=encoded%20token",
+        "x-csrf-token": "encoded token",
+        origin: "https://app.example",
+      }),
+    ),
+  ).toBe(true);
+});