CSRF tokens

[ErikMichelson]

While writing some docs for the API, I saw that many endpoints do not need a csrf-token that maybe should need one. While a simple /logout just disturbs the user, a DELETE /history might produce some damage... Maybe we could add a random token into the sessionStorage during login, keep track of that token server-side and use that? Or we use the "delete-profile-token"?

[SISheogorath]

Yes, we should do proper CSRF, the delete-profile-token is pretty much a cheap version of CSRF.

There is middleware for express that implements CSRF, I just didn't find the time to figure out all places where we want to put it.

https://github.com/expressjs/csurf

Might be something for Hacktoberfest, when we figure out what calls need it.

[ccoenen]

I think once the basic facilities are in place, adding to or removing from certain requests is probably not a big deal. I'd say: if anyone wants to work on this: give it a go!

[davidmehren]

If I understand it correctly, we can still use the express plugin with NestJS. This would work like this:

• The backend sends a CSRF-Token in a cookie, lets call that XSRF-TOKEN
• The frontend gets the token from the XSRF-TOKEN cookie and adds it to every request in a XSRF-Token header
• The server verifies that all requests contain a XSRF-Token header with a valid token.

Reference: https://cheatsheetseries.owasp.org/cheatsheets/Cross-Site_Request_Forgery_Prevention_Cheat_Sheet.html#double-submit-cookie