Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Add CSRF token to GraphiQL view #35

Open
wants to merge 1 commit into
base: master
Choose a base branch
from
Open

Add CSRF token to GraphiQL view #35

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
8 changes: 6 additions & 2 deletions src/express/express.js
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -16,14 +16,18 @@ function sendError(response, boom) {
response.status(statusCode).send(payload);
}

export default function middleware({ graphiql = true, context = {}, schema = required() } = {}) {
export default function middleware({ graphiql = true, context = {}, schema = required(), getCSRFToken = null } = {}) {
return (request, response, next) => {
if (isPath(request) && (isPost(request) || isGet(request))) {
const body = request.body;
const { query, variables } = Object.assign({}, body, request.query);

if (isGet(request) && request.accepts('html') && graphiql) {
return response.send(renderGraphiQL({ query, variables }));
const renderOptions = { query, variables };
if (getCSRFToken !== null) {
renderOptions.csrfToken = getCSRFToken(request);
}
return response.send(renderGraphiQL(renderOptions));
}

if (isGet(request) && query && query.includes('mutation')) {
Expand Down
6 changes: 4 additions & 2 deletions src/util/util.js
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -16,7 +16,8 @@ export function required() {

const GRAPHIQL_VERSION = '0.7.1';

export function renderGraphiQL({ query, variables, version = GRAPHIQL_VERSION } = {}) {
export function renderGraphiQL({ query, variables, version = GRAPHIQL_VERSION, csrfToken } = {}) {
csrfToken = csrfToken ? `,'x-csrf-token': '${csrfToken}'` : '';
Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

It's usually a good idea to treat function parameters as immutable. In this case a better name could perhaps be csrfHeader, as it's more aligned with the actual value.

return `
<!DOCTYPE html>
<html>
Expand Down Expand Up @@ -89,7 +90,8 @@ export function renderGraphiQL({ query, variables, version = GRAPHIQL_VERSION }
method: 'post',
headers: {
'Accept': 'application/json',
'Content-Type': 'application/json',
'Content-Type': 'application/json'
Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

You can leave the trailing comma on this line. The main benefit of trailing commas is that they help reduce the size of diffs. This diff section could be +1 instead of +2 -1.

Copy link
Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@CMTegner good points. I don't have time to see this through to completion, as I no longer use this library.

${csrfToken}
},
body: JSON.stringify(graphQLParams),
credentials: 'include',
Expand Down