CSRF

.js

  CSRFProtection: (req, publicRoutes = false) => {
    if (req.headers['x-sboauth']) {
      const userProfile = jwt_decode(req.headers['x-sboauth']);
      console.log('============ USER PROFILE FROM SBOAUTH ============');
      console.log({ userProfile });
      req.user = userProfile;
      return;
    }

    if (publicRoutes) {
      const methods = publicRoutes.methods || oneOrMany(publicRoutes.method);
      if (!isUrlMatch(publicRoutes, req.path) || !isMethodMatch(methods, req.method)) {
        console.log('============== CSRF PROTECTION ===============');
        console.log(req.headers);
        console.log(req.cookies);

        if (req.originalUrl.includes('/users/my/profile') && req.headers['x-csrf']) {
          // Library API is on a different domain so have to reduce security
          const userProfile = jwt_decode(req.headers['x-csrf']);
          console.log('============ USER PROFILE FROM X-CSRF ============');
          console.log({ userProfile });
          req.user = userProfile;
          return;
        }

        if (req.headers['x-csrf'] === req.cookies['c']) {
          const userProfile = jwt_decode(req.cookies['c']);
          console.log('============ USER PROFILE FROM COOKIES ============');
          console.log({ userProfile });
          req.user = userProfile;
          return;
        }
      }
    }
    console.log('CSRF Security Failure');
  }