TheCloud/v
1
0
Fork 0
mirror of https://github.com/vlang/v.git synced 2025-09-07 22:30:57 -04:00
Code Issues Packages Projects Releases Wiki Activity

veb.csrf: do not print anything by default, add an verbose: true option, to restore the old behavior if needed (#23725)

Browse Source
This commit is contained in:
Anonymous User 2025-02-15 06:15:32 -08:00 committed by GitHub
parent b438f9229d
commit b4182301ae
No known key found for this signature in database
GPG Key ID: B5690EEEBB952194
1 changed files with 15 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

19
vlib/veb/csrf/csrf.v
View File

@ -40,6 +40,8 @@ pub:
cookie_domain string cookie_domain string
// whether the cookie can be send only over HTTPS // whether the cookie can be send only over HTTPS
secure bool secure bool
// enable printing verbose statements
verbose bool
} }
pub struct CsrfContext { pub struct CsrfContext {
@ -136,7 +138,9 @@ pub fn protect(mut ctx veb.Context, config &CsrfConfig) bool {
} }
// retrieve timestamp and nonce from csrftoken // retrieve timestamp and nonce from csrftoken
data := base64.url_decode_str(actual_token).split('.') data := base64.url_decode_str(actual_token).split('.')
println(data) if config.verbose {
eprintln('[CSRF] Token data: ${data}')
}
if data.len < 3 { if data.len < 3 {
request_is_invalid(mut ctx) request_is_invalid(mut ctx)
return false return false
@ -164,15 +168,22 @@ pub fn protect(mut ctx veb.Context, config &CsrfConfig) bool {
// generate new hmac based on information in the http request // generate new hmac based on information in the http request
expected_hash := generate_cookie(expire_timestamp, expected_token, config.secret) expected_hash := generate_cookie(expire_timestamp, expected_token, config.secret)
eprintln(actual_hash) if config.verbose {
eprintln(expected_hash) eprintln('[CSRF] Actual Hash: ${actual_hash}')
eprintln('[CSRF] Expected Hash: ${expected_hash}')
}
// if the new hmac matches the cookie value the request is legit // if the new hmac matches the cookie value the request is legit
if actual_hash != expected_hash { if actual_hash != expected_hash {
if config.verbose {
eprintln('[CSRF] The actual hash differs from the expected hash')
}
request_is_invalid(mut ctx) request_is_invalid(mut ctx)
return false return false
} }
eprintln('matching') if config.verbose {
eprintln('[CSRF] The actual hash matches the expected hash')
}
return true return true
} }