node.js - 用于特定 Controller 路由的 NestJS CSRF

Question

我只想将 csrf 用于 Controller 而不是整个应用程序。

@UsePipes(new CsrfPipe())

import { PipeTransform, Injectable, ArgumentMetadata } from '@nestjs/common';
import * as csrf from 'csurf';

@Injectable()
export default class CsrfPipe implements PipeTransform {
  transform(value: any, metadata: ArgumentMetadata) {
    if (metadata.type == 'body') {
      const csrfProtection = csrf({ cookie: true });
      csrfProtection(); // what shall I do here ?
    }

    return value;
  }
}

Answer 1

试试这个

export class AppModule implements NestModule {
  configure(consumer: MiddlewareConsumer) {
    //Apply csrf for specific routes
    consumer.apply(csrf({ cookie: true })).forRoutes(
      { path: 'auth/login', method: RequestMethod.POST },
      {
        path: 'auth/csrf',
        method: RequestMethod.GET,
      },
    );
  }
}