feat: csrf, two tokens verify

Author: fishwww-ww

packages/service/common/middle/csrf.ts

@@ -0,0 +1,32 @@
+import type { NextApiRequest, NextApiResponse } from 'next';
+import { verifyCsrfToken } from '../../support/permission/auth/common';
+import { generateCsrfToken } from '../../../../projects/app/src/web/support/user/api';
+
+export const withCSRFCheck = async (
+  req: NextApiRequest,
+  res: NextApiResponse,
+  isCSRFCheck: boolean = true
+) => {
+  if (!isCSRFCheck) return;
+
+  try {
+    const csrfToken = await getCsrfTokenFromRequest(req);
+    verifyCsrfToken(csrfToken || '');
+  } catch (error) {
+    return res.status(403).json({
+      code: 403,
+      message: 'Invalid CSRF token'
+    });
+  }
+};
+
+async function getCsrfTokenFromRequest(req: NextApiRequest): Promise<string | null> {
+  const headerToken = req.headers['x-csrf-token'];
+
+  if (!headerToken || typeof headerToken !== 'string') {
+    const { csrfToken } = await generateCsrfToken();
+    return csrfToken;
+  }
+
+  return headerToken;
+}

packages/service/common/middle/entry.ts

@@ -3,31 +3,46 @@ import type { NextApiRequest, NextApiResponse } from 'next';
 import { withNextCors } from './cors';
 import { type ApiRequestProps } from '../../type/next';
 import { addLog } from '../system/log';
+import { withCSRFCheck } from './csrf';
 
 export type NextApiHandler<T = any> = (
   req: ApiRequestProps,
   res: NextApiResponse<T>
 ) => unknown | Promise<unknown>;
 
+type NextAPIOptsType = {
+  isCSRFCheck: boolean;
+};
+type Args = [...NextApiHandler[], NextAPIOptsType] | NextApiHandler[];
+
 export const NextEntry = ({
   beforeCallback = []
 }: {
   beforeCallback?: ((req: NextApiRequest, res: NextApiResponse) => Promise<any>)[];
 }) => {
-  return (...args: NextApiHandler[]): NextApiHandler => {
+  return (...args: Args): NextApiHandler => {
+    const opts = (() => {
+      if (typeof args.at(-1) === 'function') {
+        return {
+          isCSRFCheck: true
+        } as NextAPIOptsType;
+      }
+      return args.at(-1) as NextAPIOptsType;
+    })();
     return async function api(req: ApiRequestProps, res: NextApiResponse) {
       const start = Date.now();
       addLog.debug(`Request start ${req.url}`);
 
       try {
         await Promise.all([
           withNextCors(req, res),
+          withCSRFCheck(req, res, opts.isCSRFCheck),
           ...beforeCallback.map((item) => item(req, res))
         ]);
 
         let response = null;
         for await (const handler of args) {
-          response = await handler(req, res);
+          if (typeof handler === 'function') response = await handler(req, res);
           if (res.writableFinished) {
             break;
           }

packages/service/support/permission/auth/common.ts

@@ -8,6 +8,7 @@ import { ERROR_ENUM } from '@fastgpt/global/common/error/errorCode';
 import { authUserSession } from '../../../support/user/session';
 import { authOpenApiKey } from '../../../support/openapi/auth';
 import { AuthUserTypeEnum } from '@fastgpt/global/support/permission/constant';
+import jwt from 'jsonwebtoken';
 
 export const authCert = async (props: AuthModeType) => {
   const result = await parseHeaderCert(props);
@@ -171,3 +172,36 @@ export const setCookie = (res: NextApiResponse, token: string) => {
 export const clearCookie = (res: NextApiResponse) => {
   res.setHeader('Set-Cookie', `${TokenName}=; Path=/; Max-Age=0`);
 };
+
+/* CSRF token */
+export const CsrfTokenName = 'csrf_token';
+
+/* set CSRF cookie */
+export const setCsrfCookie = (res: NextApiResponse, token: string) => {
+  res.setHeader(
+    'Set-Cookie',
+    `${CsrfTokenName}=${token}; Path=/; HttpOnly; Max-Age=3600; Samesite=Strict;`
+  );
+};
+
+/* clear CSRF cookie */
+export const clearCsrfCookie = (res: NextApiResponse) => {
+  res.setHeader('Set-Cookie', `${CsrfTokenName}=; Path=/; Max-Age=0`);
+};
+
+/* verify CSRF JWT token */
+export const verifyCsrfToken = (token: string): any => {
+  try {
+    const jwtSecret = process.env.TOKEN_KEY || 'any';
+    const decoded = jwt.verify(token, jwtSecret, { algorithms: ['HS256'] });
+
+    if (typeof decoded === 'object' && decoded.type === 'csrf') {
+      return decoded;
+    }
+
+    throw new Error('Invalid CSRF token type');
+  } catch (error) {
+    const errorMessage = error instanceof Error ? error.message : 'Unknown error';
+    throw new Error(`CSRF token verification failed: ${errorMessage}`);
+  }
+};

projects/app/src/components/Markdown/index.tsx

@@ -183,8 +183,7 @@ const MarkdownRender = ({
                 'base',
                 'form',
                 'input',
-                'button',
-                'img'
+                'button'
               ]
             }
           ]

projects/app/src/pages/api/common/file/upload.ts

@@ -113,7 +113,7 @@ async function handler(req: NextApiRequest, res: NextApiResponse<any>) {
   removeFilesByPaths(filePaths);
 }
 
-export default NextAPI(handler);
+export default NextAPI(handler, { isCSRFCheck: false });
 
 export const config = {
   api: {

projects/app/src/pages/api/common/file/uploadImage.ts

@@ -13,7 +13,7 @@ async function handler(req: NextApiRequest, res: NextApiResponse): Promise<strin
   return uploadMongoImg({ teamId, ...body });
 }
 
-export default NextAPI(handler);
+export default NextAPI(handler, { isCSRFCheck: false });
 
 export const config = {
   api: {

projects/app/src/pages/api/core/app/exportChatLogs.ts

@@ -417,5 +417,6 @@ async function handler(req: ApiRequestProps<ExportChatLogsBody, {}>, res: NextAp
 
 export default NextAPI(
   useIPFrequencyLimit({ id: 'export-chat-logs', seconds: 60, limit: 1, force: true }),
-  handler
+  handler,
+  { isCSRFCheck: false }
 );

projects/app/src/pages/api/core/dataset/collection/create/fileId.ts

@@ -61,4 +61,4 @@ async function handler(
   };
 }
 
-export default NextAPI(handler);
+export default NextAPI(handler, { isCSRFCheck: false });

projects/app/src/pages/api/core/dataset/collection/create/images.ts

@@ -95,7 +95,7 @@ async function handler(
   }
 }
 
-export default NextAPI(handler);
+export default NextAPI(handler, { isCSRFCheck: false });
 
 export const config = {
   api: {

projects/app/src/pages/api/core/dataset/collection/create/localFile.ts

@@ -88,4 +88,4 @@ export const config = {
   }
 };
 
-export default NextAPI(handler);
+export default NextAPI(handler, { isCSRFCheck: false });